Advanced Persistent Threats
|
|
- Imogen Andrews
- 8 years ago
- Views:
Transcription
1 Advanced Persistent Threats Craig Harwood Channel Manager SADC and Indian Ocean Islands 1
2 Agenda Introduction Today s Threat landscape What is an Advance persistent Threat How are these crimes perpetrated Why traditional security measures alone are no longer effective Why is security Management and compliance so important Solutions and Technologies to help YOU! 2
3 The Hyperextended Enterprise Expanding entities, explosive information growth, increased regulation Enterprise HQ Hijacks Data Theft Application Hacking Remote Offices Cookies Screen Scraping Service Theft Spoofing, BOTNETS Phishing Virtualization, Cloud Computing & other ISPs Threats are Everywhere Cyber Attacks on Apps. & Infrastructure Retail Stores Service Provider Distribution Centers Industrial Espionage Extortion Identity Theft, Privacy Viruses, Worms, P2P Content Piracy, SPAM Solicitation Mobile Workers Telecommuter s Supply Chain & Collaboration Partners Consumers 3
4 The Attacking Community is Professionalizing Governments Enterprise HQ Hijacks Data Theft Application Hacking Remote Offices Cookies Screen Scraping Organized Crime PII, Government, Defense, Industrial Base, IP Rich Enterprises Anti- Establishment Vigilantes Service Theft Spoofing, BOTNETS Phishing Virtualization, Cloud Computing & other ISPs Threats are Everywhere Cyber Attacks on Apps. & Infrastructure Retail Stores Service Provider Distribution Centers Industrial Espionage Extortion Identity Theft, Privacy Viruses, Worms, P2P Content Piracy, SPAM Solicitation Mobile Workers Supply Chain & Collaboration Partners Telecommuters Consumers Organized, sophisticated Supply chains (PII, Financial Services, Retail) Terrorists Hacktivists Targets of Opportunity In % of the Global 500 had BOTNET Agencies activity associated with their domains RSA Security Brief, February 2011 Malware and the Enterprise Between 2006 and 2010 there was a 660% Agencies increase in Cyber Incidents reported from Government Agencies Government Accountability Office and Time Magazine, July 2011 PII, Government Critical Infrastructure 4
5 On the surface all may seem calm! 5
6 What are we facing? Well organized, well funded entities with a specific set of Collection Requirements (CR) that may be controlled by a gov t or criminal entity CR s could be anything from military secrets to source code to pharmaceutical intellectual property to documentation about critical infrastructure 6
7 Advanced Persistent Threat (APT) Targeted Computer Attacks By Government Agencies, Cyber Criminals, Terrorists And/Or Individuals With The Intent Of Stealing Intellectual Property, Trade Secrets Or Other Political/Economical Motivation. 7
8 Advanced Persistent Threats The New Norm 18 months of high-profile sophisticated cyber attacks; pandemic levels, not a passing fad Advanced Persistent Threats have moved from realm of military to mainstream Highly targeted, well researched and well funded Moving beyond credit card data to intellectual property Multiple vectors: social engineering, zero-day vulnerabilities, application-layer exploits, etc. The primary attack vector has shifted from technology to people Of companies 83% 71% 65% believe that they have been the victim of advanced threat have seen an increase in advanced threats in the last 12 months believe they have insufficient resources to prevent advanced threats Of advanced persistent 51% 45% threats 44% result in IT downtime result in the theft of intellectual property result in the theft of confidential or sensitive information Source: Ponemon Institute Survey Growing Risk of Advanced Threats It is now not a question of IF but WHEN you are attacked but more importantly will you notice, and can you react? 8
9 The Age of Advanced Persistent Threats Who Cyber Criminals How Open Source Intelligence Collection Third Countries Nation State Actors Advanced Persistent Threats Foreign Nationals Black Markets Non-Nation State Sophisticate d attacks and well resourced adversaries Sub Contractors Supply Chain Tampering 9
10 Tactics, Techniques and Procedures (TTP s) There are typically precursors to APT attacks. Knowing the TTP s used by threat actors can give an organization a jump start on defending the network. The following are the steps used by APT threat actors when staging attacks. This is referred to as the APT killchain Open Source Collection Malware and toolkit creation Delivery of malware Exploitation Command and Control communications (C2 beaconing) Exfiltration 10
11 Open source collection TTP Identify high value programs, technology and people Threat actors will use open source data to research their targets. There is a surprising amount of information freely available Clean documents are harvested from Internet sources A company s public website News stories (CNN, FOX News, etc) Relationships are researched which can be leveraged in an attack 11
12 Malware and toolkit creation The act of placing malicious payload inside the delivery mechanism (i.e. DOC or PDF file) APT actors use a variety of custom toolkits to create malware Metasploit modules bring toolkits to a larger audience Link based attacks are on the rise and much harder to detect 13
13 Delivery methods Threat actors will utilize intelligence gathered from their collections to target specific users. s will typically contain a link or attachment that entices the recipient. The malware is sophisticated and will evade most standard COTS software. Other server side attacks have also been observed such as SQL Injections Water holing is another popular technique 15
14 Exploitation Threat actors will attempt to exploit a system using specially crafted malware. The main goal is to compromise the target asset that will allow the attacker access to the system This is a key phase of the attack, If exploitation is successful, the machine is compromised Tendency toward multi-stage exploits Shellcode delivered which in turns downloads & executes other malware Exploitation depends on Vulnerability, proper execution and compatibility 17
15 Command and Control Communications (C2) C2 communications is established once the target system can communicate with the threat actors infrastructure. Attackers could perform the following Tool dropping System enumeration Lateral movement Credential harvesting 19
16 Exfiltration Once the threat locates the data they are after they usually will compress the data and send out. Intellectual Property PII Government Data 21
17 Importance of knowing these TTP s These APT TTP s are commonly known in the security world as the Kill Chain Reconnaissance Delivery Command & Control Weaponization Installation & Exploitation Exfiltration 23
18 The Anatomy of an Attack Attacker Surveillance Target Analysis Access Probe Attack Set-up System Intrusion Attack Begins Cover-up Starts Discovery / Persistence Leap Frog Attacks Complete Cover-up Complete Maintain foothold Time ATTACKER FREE TIME Need to collapse attacker free time Need to ID attack precursors Physical Security Threat Analysis Attack Forecast Defender discovery Monitoring & Controls Attack Identified Incident Reporting Containment & eradication Source: NERC HILF Report, June 2010 ( Impact Analysis Damage Identification System Reaction Response Recovery 24
19 What Can you do About APT s? Focus is on breaking the kill-chain before exfiltration Deveopment of a proactive approach to the detection of APT Understanding the methodologies used by attackers allows organizations to select safeguards and security controls to counter the threat. 25
20 Customer Breached by Hackers, APT s or Malicious Code 26
21 Companies that have been compromised 27
22 More examples 28
23 More examples 29
24 More Examples 30
25 More Examples 31
26 Security Today (and for the last 5 years) 32
27 Traditional Security is Not Working 99% of breaches led to compromise within days or less with 85% leading to data exfiltration in the same time 85% of breaches took weeks or more to discover Source: Verizon 2012 Data Breach Investigations Report 33
28 Transforming Security address the pervasiveness of dynamic, focused adversaries Advanced Security Traditional Security Close Signature-based the risk gap Perimeter oriented Compliance Driven Deliver new intelligence Enable agility Advanced Threat Agile Definitive Intelligent 34
29 Security Paradigm Shift Shift From Perimeter-Based Security Model To An Intelligence-Based Model. Risk-Based Agile Contextual Information Sharing Peers, Government, etc Intel Cannot Just Be Gathered Internally, It Also Needs To Come From External Sources Pattern Recognition Predictive Big-Data Analytics 35
30 Today s tools need to adapt Today s tools need to be able to detect and investigate Lateral movement of threats as they gain foothold Covert characteristics of attack tools, techniques & procedures Exfiltration or sabotage of critical data Today s tools need to be able to scale To collect and store the volume and diversity of data required To provide analytic tools to support security work streams Time to respond is critical in a breach situations and SIEM often falls short 36
31 Identities Service Theft Spoofing, BOTNETS Phishing Hijacks Data Theft Application Hacking Cyber Attacks on Apps. & Infrastructure Industrial Espionage Extortion Identity Theft, Privacy Viruses, Worms, P2P Content Piracy, SPAM Solicitation Cookies Screen Scraping Integrated Advanced Security Manage Governance, Risk and Compliance BUSINESS DRIVERS GOVERNANCE, RISK AND COMPLIANCE MANAGEMENT DASHBOARD DEFINE POLICIES POLICIES AND PROCESSES CONTROLS PROTECT AND DEFEND Monitor DETECT Enterprise HQ Virtualization, Cloud Computing & other ISPs Threats are Everywhere Remote Offices Service Provider Retail Stores Supply Chain & Collaboration Partners Distribution Centers Mobile Workers Telecommuters Consumers Information INVESTIGATE REMEDIATE Infrastructure Update controls 37
32 SIEM has been a good start SIEM can provide: Valuable reporting on device and application activity Basic alerting on known sequences (i.e. basic correlation) Proof of compliance for internal and external auditors Central view into disparate event sources being collected In today s world Threats are multi-faceted, dynamic and stealthy The most dangerous attacks have never been seen before Threats often don t leave a footprint in logs 38
33 Introducing RSA Security Analytics 39
34 What is RSA Security Analytics? RSA Security Analytics is RSA s platform for Security monitoring Incident investigation Malware analytics Log compliance reporting Is the cornerstone of RSA s Security Management & Big Data strategy Going beyond envision and NetWitness a new approach to security operations RSA Security Analytics is the convergence of envision/siem with Netwitness high speed analytics and forensics 40
35 Suspect Attack Scenario Spike in Suspect Network Traffic IP Address shows multiple RDP connections tunneled over non-standard port Authorized User Logged in to AD AD Logs show user logged in from suspect IP with authorized credentials PASSWORD 1 2 Different user logged into VPN from same IP VPN logs show a different set of authorized credentials used to log into VPN 3 4 PASSWORD Data ex-filtration Encrypted ZIP file transferred out to Internet via FTP server 42
36 Only RSA Security Analytics can tell you the impact of the attack Attack Step Traditional SIEM RSA Security Analytics Alert for RDP tunneled over nonstandard port Recreate activity of suspect IP address across environment Show user activity across AD and VPN Alert for different credentials used for AD and VPN Reconstruct exfiltrated data No No Yes Yes No Yes Yes Yes Yes Yes 43
37 Investigation Scenario Find Workstation acting as SPAM host Multiple outbound SMTP connections from workstation. Multiple internet DNS connections from workstation 1 Find out how the workstation got infected User clicked on the link and got infected by Trojan from drive-by download. 2 Analyze malware Determine whether targeted or vanilla malware in use 4 Recreate phishing message Determine whether targeted phishing attack at play 3 44
38 Only RSA Security Analytics can tell if this is a targeted attack Attack Step Traditional SIEM RSA Security Analytics Alert for suspected SPAM host Yes Yes Show all WWW requests where executable downloaded Recreate with suspect link No No Yes Yes Analyze malware and incorporate community intelligence Determine whether attack is part of a targeted campaign No No Yes Yes 45
39 Separating Bad from Good is Increasingly Difficult = BAD = BAD Understand what bad looks like and look for similarities Antivirus Intrusion Prevention Systems Understand Thresholds what exceeded good looks like and look for meaningful differences Network analysis and baselining Anomaly detection Predictive failure analysis Key Point: Increasingly sophisticated models of both good and bad are needed. Better models require more data and analytics. 46
40 Security Analytics Methodology: Ripping away the hay with automated queries Start with all network traffic and logs SHOW ME all downloads of executable content (pdf, doc, exe, xls, jar etc) SHOW ME files where file type does not match extension ALERT ME for sessions to/from critical assets No SIEM will let you do this! 47
41 Know Everything Answer Anything 48
42 THANK YOU 49
The Next Generation Security Operations Center
The Next Generation Security Operations Center Vassil Barsakov Regional Manager, CEE & CIS RSA, the Security Division of EMC 1 Threats are Evolving Rapidly Criminals Petty criminals Unsophisticated Organized
More informationRSA Security Anatomy of an Attack Lessons learned
RSA Security Anatomy of an Attack Lessons learned Malcolm Dundas Account Executive John Hurley Senior Technology Consultant 1 Agenda Advanced Enterprise/ Threats The RSA Breach A chronology of the attack
More informationUsing Network Forensics to Visualize Advanced Persistent Threats
Using Network Forensics to Visualize Advanced Persistent Threats Dale Long, Sr. Technology Consultant, RSA Security 1 The Problem 2 Traditional Security Is Not Working 99% of breaches led to compromise
More informationSecurity Analytics for Smart Grid
Security Analytics for Smart Grid Dr. Robert W. Griffin Chief Security Architect RSA, the Security Division of EMC robert.griffin@rsa.com blogs.rsa.com/author/griffin @RobtWesGriffin 1 No Shortage of Hard
More informationGetting Ahead of Advanced Threats
Getting Ahead of Advanced Threats Advanced Security Solutions for Trusted IT Chezki Gil Territory Manager Israel & Greece 1 Threats are Evolving Rapidly Criminals Petty criminal s Unsophisticated Organized
More informationAdvanced Threats: The New World Order
Advanced Threats: The New World Order Gary Lau Technology Consulting Manager Greater China gary.lau@rsa.com 1 Agenda Change of Threat Landscape and Business Impact Case Sharing Korean Incidents EMC CIRC
More informationBIG DATA. Shaun McLagan General Manager, RSA Australia and New Zealand CHANGING THE REALM OF POSSIBILITY IN SECURITY
BIG DATA CHANGING THE REALM OF POSSIBILITY IN SECURITY Shaun McLagan General Manager, RSA Australia and New Zealand 1 Things have changed #2 Buzz word 2012 Big Data only behind something called Fiscal
More informationThe Future of the Advanced SOC
The Future of the Advanced SOC Developing a platform for more effective security management and compliance Steven Van Ormer RSA Technical Security Consultant 1 Agenda Today s Security Landscape and Why
More informationRSA Security Analytics the complete approach to security monitoring or how to approach advanced threats
RSA Security Analytics the complete approach to security monitoring or how to approach advanced threats Grzegorz Mucha grzegorz.mucha@rsa.com Advanced Threats Threat Landscape Criminals Petty criminals
More informationSecurity and Privacy
Security and Privacy Matthew McCormack, CISSP, CSSLP CTO, Global Public Sector, RSA The Security Division of EMC 1 BILLIONS OF USERS MILLIONS/BILLIONS OF APPS 2010 Cloud Big Data Social Mobile Devices
More informationIMPLEMENTING A SECURITY ANALYTICS ARCHITECTURE
IMPLEMENTING A SECURITY ANALYTICS ARCHITECTURE Solution Brief SUMMARY New security threats demand a new approach to security management. Security teams need a security analytics architecture that can handle
More informationDefending Against Cyber Attacks with SessionLevel Network Security
Defending Against Cyber Attacks with SessionLevel Network Security May 2010 PAGE 1 PAGE 1 Executive Summary Threat actors are determinedly focused on the theft / exfiltration of protected or sensitive
More informationRSA Security Analytics
RSA Security Analytics This is what SIEM was Meant to Be 1 The Original Intent of SIEM Single compliance & security interface Compliance yes, but security? Analyze & prioritize alerts across various sources
More informationBREAKING THE KILL CHAIN AN EARLY WARNING SYSTEM FOR ADVANCED THREAT
BREAKING THE KILL CHAIN AN EARLY WARNING SYSTEM FOR ADVANCED THREAT Rashmi Knowles RSA, The Security Division of EMC Session ID: Session Classification: SPO-W07 Intermediate APT1 maintained access to
More informationFighting Off an Advanced Persistent Threat & Defending Infrastructure and Data. Dave Shackleford February, 2012
Fighting Off an Advanced Persistent Threat & Defending Infrastructure and Data Dave Shackleford February, 2012 Agenda Attacks We ve Seen Advanced Threats what s that mean? A Simple Example What can we
More informationDefending Against Data Beaches: Internal Controls for Cybersecurity
Defending Against Data Beaches: Internal Controls for Cybersecurity Presented by: Michael Walter, Managing Director and Chris Manning, Associate Director Protiviti Atlanta Office Agenda Defining Cybersecurity
More informationdefending against advanced persistent threats: strategies for a new era of attacks agility made possible
defending against advanced persistent threats: strategies for a new era of attacks agility made possible security threats as we know them are changing The traditional dangers IT security teams have been
More informationCybersecurity Kill Chain. William F. Crowe, CISA, CISM, CRISC, CRMA September 2015 ISACA Jacksonville Chapter Meeting August 13, 2015
Cybersecurity Kill Chain William F. Crowe, CISA, CISM, CRISC, CRMA September 2015 ISACA Jacksonville Chapter Meeting August 13, 2015 Who Am I? Over 20 years experience with 17 years in the financial industry
More informationAfter the Attack. The Transformation of EMC Security Operations
After the Attack The Transformation of EMC Security Operations Thomas Wood Senior Systems Engineer, GSNA CISSP RSA, The Security Division of EMC Thomas.WoodJr@rsa.com 1 Agenda Review 2011 Attack on RSA
More informationPartner. Copyright 2011 EMC Corporation. All rights reserved.
Partner 2012 2012 1 WELCOME Corné van Rooij, DM Benelux & Switzerland 2 RSA Partner Kick Off 26 January 2012 Agenda: 12.30 Welcome - Corné van Rooij, DM Benelux & Switzerland 12.30:13.00 Strategy 2012,
More informationAddressing APTs and Modern Malware with Security Intelligence Date: September 2013 Author: Jon Oltsik, Senior Principal Analyst
ESG Brief Addressing APTs and Modern Malware with Security Intelligence Date: September 2013 Author: Jon Oltsik, Senior Principal Analyst Abstract: APTs first came on the scene in 2010, creating a wave
More informationThe session is about to commence. Please switch your phone to silent!
The session is about to commence. Please switch your phone to silent! 1 Defend with Confidence Against Advanced Threats Nicholas Chia SE Manager, SEA RSA 2 TRUST? Years to earn, seconds to break 3 Market
More informationPractical Steps To Securing Process Control Networks
Practical Steps To Securing Process Control Networks Villanova University Seminar Rich Mahler Director, Commercial Cyber Solutions Lockheed Martin Lockheed Martin Corporation 2014. All Rights Reserved.
More informationWho Drives Cybersecurity in Your Business? Milan Patel, K2 Intelligence. AIBA Quarterly Meeting September 10, 2015
Who Drives Cybersecurity in Your Business? Milan Patel, K2 Intelligence AIBA Quarterly Meeting September 10, 2015 The Answer 2 Everyone The relationship between the board, C-suite, IT, and compliance leaders
More informationAdvanced SOC Design. Next Generation Security Operations. Shane Harsch Senior Solutions Principal, MBA GCED CISSP RSA
Advanced SOC Design Next Generation Security Operations Shane Harsch Senior Solutions Principal, MBA GCED CISSP RSA 1 ! Why/How security investments need to shift! Key functions of a Security Operations
More informationFighting Advanced Threats
Fighting Advanced Threats With FortiOS 5 Introduction In recent years, cybercriminals have repeatedly demonstrated the ability to circumvent network security and cause significant damages to enterprises.
More informationAdvanced Threat Protection with Dell SecureWorks Security Services
Advanced Threat Protection with Dell SecureWorks Security Services Table of Contents Summary... 2 What are Advanced Threats?... 3 How do advanced threat actors operate?... 3 Addressing the Threat... 5
More informationA Case for Managed Security
A Case for Managed Security By Christopher Harper Managing Director, Security Superior Managed IT & Security Services 1. INTRODUCTION Most firms believe security breaches happen because of one key malfunction
More informationThe FBI Cyber Program. Bauer Advising Symposium //UNCLASSIFIED
The FBI Cyber Program Bauer Advising Symposium October 11, 2012 Today s Agenda What is the threat? Who are the adversaries? How are they attacking you? What can the FBI do to help? What can you do to stop
More informationUnknown threats in Sweden. Study publication August 27, 2014
Unknown threats in Sweden Study publication August 27, 2014 Executive summary To many international organisations today, cyber attacks are no longer a matter of if but when. Recent cyber breaches at large
More informationRashmi Knowles Chief Security Architect EMEA
Rashmi Knowles Chief Security Architect EMEA AGENDA Transformation of IT New cyber-security challenges Intelligence Driven Security Security Analytics Q&A 2 ENTERPRISE DATA CENTER ADVANCED SECURITY A UNIQUE
More informationTrends in Malware DRAFT OUTLINE. Wednesday, October 10, 12
Trends in Malware DRAFT OUTLINE Presentation Synopsis Security is often a game of cat and mouse as security professionals and attackers each vie to stay one step ahead of the other. In this race for dominance,
More informationHow Attackers are Targeting Your Mobile Devices. Wade Williamson
How Attackers are Targeting Your Mobile Devices Wade Williamson Today s Agenda Brief overview of mobile computing today Understanding the risks Analysis of recently discovered malware Protections and best
More informationASSUMING A STATE OF COMPROMISE: EFFECTIVE DETECTION OF SECURITY BREACHES
ASSUMING A STATE OF COMPROMISE: EFFECTIVE DETECTION OF SECURITY BREACHES Leonard Levy PricewaterhouseCoopers LLP Session ID: SEC-W03 Session Classification: Intermediate Agenda The opportunity Assuming
More informationSPEAR-PHISHING ATTACKS
SPEAR-PHISHING ATTACKS WHY THEY ARE SUCCESSFUL AND HOW TO STOP THEM WHITE PAPER RECENTLY, THERE HAS BEEN A RAPID AND DRAMATIC SHIFT FROM BROAD SPAM ATTACKS TO TARGETED EMAIL-BASED-PHISHING CAMPAIGNS THAT
More informationSpear Phishing Attacks Why They are Successful and How to Stop Them
White Paper Spear Phishing Attacks Why They are Successful and How to Stop Them Combating the Attack of Choice for Cybercriminals White Paper Contents Executive Summary 3 Introduction: The Rise of Spear
More informationThe Federal CISO Dilemma. You have to do FISMA. You must defend against cyber threats.
The Federal CISO Dilemma You have to do FISMA. You must defend against cyber threats. October 2012 Executive Summary Federal CISOs face a unique cyber security challenge copious amounts of regulatory compliance
More informationEnterprise Cybersecurity: Building an Effective Defense
Enterprise Cybersecurity: Building an Effective Defense Chris Williams Oct 29, 2015 14 Leidos 0224 1135 About the Presenter Chris Williams is an Enterprise Cybersecurity Architect at Leidos, Inc. He has
More informationCovert Operations: Kill Chain Actions using Security Analytics
Covert Operations: Kill Chain Actions using Security Analytics Written by Aman Diwakar Twitter: https://twitter.com/ddos LinkedIn: http://www.linkedin.com/pub/aman-diwakar-ccie-cissp/5/217/4b7 In Special
More informationRethinking Cyber Security in the Age of the Breach
Global Cloud Networking Advanced Managed Security Cloud Unified Communications Rethinking Cyber Security in the Age of the Breach Craig D Abreo, CISSP VP Security Operations Copyright 2015 Masergy Communica8ons,
More informationWHITEPAPER. How a DNS Firewall Helps in the Battle against Advanced Persistent Threat and Similar Malware
WHITEPAPER How a DNS Firewall Helps in the Battle against Advanced Persistent Threat and Similar Malware How a DNS Firewall Helps in the Battle against Advanced As more and more information becomes available
More informationBreaking the Cyber Attack Lifecycle
Breaking the Cyber Attack Lifecycle Palo Alto Networks: Reinventing Enterprise Operations and Defense March 2015 Palo Alto Networks 4301 Great America Parkway Santa Clara, CA 95054 www.paloaltonetworks.com
More informationSoftware that provides secure access to technology, everywhere.
Software that provides secure access to technology, everywhere. Joseph Patrick Schorr @JoeSchorr October, 2015 2015 BOMGAR CORPORATION ALL RIGHTS RESERVED WORLDWIDE 1 Agenda What are we dealing with? How
More informationSymantec Cyber Threat Analysis Program Program Overview. Symantec Cyber Threat Analysis Program Team
Symantec Cyber Threat Analysis Program Symantec Cyber Threat Analysis Program Team White Paper: Symantec Security Intelligence Services Symantec Cyber Threat Analysis Program Contents Overview...............................................................................................
More informationEnterprise Cybersecurity: Building an Effective Defense
: Building an Effective Defense Chris Williams Scott Donaldson Abdul Aslam 1 About the Presenters Co Authors of Enterprise Cybersecurity: How to Implement a Successful Cyberdefense Program Against Advanced
More informationIntroducing IBM s Advanced Threat Protection Platform
Introducing IBM s Advanced Threat Protection Platform Introducing IBM s Extensible Approach to Threat Prevention Paul Kaspian Senior Product Marketing Manager IBM Security Systems 1 IBM NDA 2012 Only IBM
More informationBernard Montel Directeur Technique RSA. Copyright 2012 EMC Corporation. All rights reserved.
Bernard Montel Directeur Technique RSA 1 RSA Security Management Compliance Vision Delivering Visibility, Intelligence and Governance 2 Traditional Security Is Not Working 99% of breaches led to compromise
More informationSECURITY REIMAGINED SPEAR PHISHING ATTACKS WHY THEY ARE SUCCESSFUL AND HOW TO STOP THEM. Why Automated Analysis Tools are not Created Equal
WHITE PAPER SPEAR PHISHING ATTACKS WHY THEY ARE SUCCESSFUL AND HOW TO STOP THEM Why Automated Analysis Tools are not Created Equal SECURITY REIMAGINED CONTENTS Executive Summary...3 Introduction: The Rise
More informationGOOD GUYS VS BAD GUYS: USING BIG DATA TO COUNTERACT ADVANCED THREATS. Joe Goldberg. Splunk. Session ID: SPO-W09 Session Classification: Intermediate
GOOD GUYS VS BAD GUYS: USING BIG DATA TO COUNTERACT ADVANCED THREATS Joe Goldberg Splunk Session ID: SPO-W09 Session Classification: Intermediate About Me Joe Goldberg Current: Splunk - Security Evangelist
More informationIncident Response. Proactive Incident Management. Sean Curran Director
Incident Response Proactive Incident Management Sean Curran Director Agenda Incident Response Overview 3 Drivers for Incident Response 5 Incident Response Approach 11 Proactive Incident Response 17 2 2013
More informationMalicious Network Traffic Analysis
Malicious Network Traffic Analysis Uncover system intrusions by identifying malicious network activity. There are a tremendous amount of network based attacks to be aware of on the internet today and the
More informationUnderstanding the Advanced Threat Landscape an MSPs Guide. IT Security: Enabled
Understanding the Advanced Threat Landscape an MSPs Guide IT Security: Enabled 1.0 Cutting through the APT hype to help your clients prevent, detect and mitigate advanced threats Sophisticated cyber-espionage
More information場 次 :C-3 公 司 名 稱 :RSA, The Security Division of EMC 主 題 : 如 何 應 用 網 路 封 包 分 析 對 付 資 安 威 脅 主 講 人 :Jerry.Huang@rsa.com Sr. Technology Consultant GCR
場 次 :C-3 公 司 名 稱 :RSA, The Security Division of EMC 主 題 : 如 何 應 用 網 路 封 包 分 析 對 付 資 安 威 脅 主 講 人 :Jerry.Huang@rsa.com Sr. Technology Consultant GCR Minimum Requirements of Security Management and Compliance
More informationThe Mile High Denver Chapter of ARMA welcomes you to our virtual meeting!
The Mile High Denver Chapter of ARMA welcomes you to our virtual meeting! March 18 th Meeting ediscovery and Social Media -- What Records Managers Need to Know By: Kelly Twigger Americans spend an average
More informationCertified Ethical Hacker (CEH) Ethical Hacking & Counter Measures Course 9962; 5 Days, Instructor-Led
Certified Ethical Hacker (CEH) Ethical Hacking & Counter Measures Course 9962; 5 Days, Instructor-Led Course Description This class will immerse the student into an interactive environment where they will
More informationSession 9: Changing Paradigms and Challenges Tools for Space Systems Cyber Situational Awareness
Session 9: Changing Paradigms and Challenges Tools for Space Systems Cyber Situational Awareness Wayne A. Wheeler The Aerospace Corporation GSAW 2015, Los Angeles, CA, March 2015 Agenda Emerging cyber
More informationUNCLASSIFIED. http://www.govcertuk.gov.uk. General Enquiries. Incidents incidents@govcertuk.gov.uk Incidents incidents@govcertuk.gsi.gov.uk.
Version 1.2 19-June-2013 GUIDELINES Incident Response Guidelines Executive Summary Government Departments have a responsibility to report computer incidents under the terms laid out in the SPF, issued
More informationCyber Threats Insights from history and current operations. Prepared by Cognitio May 5, 2015
Cyber Threats Insights from history and current operations Prepared by Cognitio May 5, 2015 About Cognitio Cognitio is a strategic consulting and engineering firm led by a team of former senior technology
More information應 用 SIEM 偵 測 與 預 防 APT 緩 攻 擊
應 用 SIEM 偵 測 與 預 防 APT 緩 攻 擊 HP Enterprise Security 林 傳 凱 (C. K. Lin) Senior Channel PreSales, North Asia HP ArcSight, Enterprise Security 1 Rise Of The Cyber Threat Enterprises and Governments are experiencing
More information24/7 Visibility into Advanced Malware on Networks and Endpoints
WHITEPAPER DATA SHEET 24/7 Visibility into Advanced Malware on Networks and Endpoints Leveraging threat intelligence to detect malware and exploitable vulnerabilities Oct. 24, 2014 Table of Contents Introduction
More informationInto the cybersecurity breach
Into the cybersecurity breach Tim Sanouvong State Sector Cyber Risk Services Deloitte & Touche LLP April 3, 2015 Agenda Setting the stage Cyber risks in state governments Cyber attack vectors Preparing
More informationEndpoint Threat Detection without the Pain
WHITEPAPER Endpoint Threat Detection without the Pain Contents Motivated Adversaries, Too Many Alerts, Not Enough Actionable Information: Incident Response is Getting Harder... 1 A New Solution, with a
More informationADVANCED THREATS IN THE ENTERPRISE. Finding an Evil in the Haystack with RSA ECAT. White Paper
ADVANCED THREATS IN THE ENTERPRISE Finding an Evil in the Haystack with RSA ECAT White Paper With thousands of workstations and servers under management, most enterprises have no way to effectively make
More informationINDUSTRY OVERVIEW: HEALTHCARE
ii IBM MSS INDUSTRY OVERVIEW: HEALTHCARE RESEARCH AND INTELLIGENCE REPORT RELEASE DATE: OCTOBER 7, 2014 BY: JOHN KUHN, SENIOR THREAT RESEARCHER iii TABLE OF CONTENTS EXECUTIVE OVERVIEW/KEY FINDINGS...
More informationAdvanced Cyber Threats in State and Local Government
RESEARCH SURVEY Advanced Cyber Threats in State and Local Government January 2014 SHUTTERSTOCK UNDERWRITTEN BY: Section 1: Executive Overview In the past, scattershot, broad-based attacks were often more
More informationENDPOINT SECURITY WHITE PAPER. Endpoint Security and Advanced Persistent Threats WWW.COMODO.COM
WHITE PAPER Endpoint Security and Advanced Persistent Threats The Invisible Threat They re out there waiting. Sitting at their computers hoping for you to make a mistake. And you will. Because no one is
More informationComprehensive Advanced Threat Defense
1 Comprehensive Advanced Threat Defense June 2014 PAGE 1 PAGE 1 1 INTRODUCTION The hot topic in the information security industry these days is Advanced Threat Defense (ATD). There are many definitions,
More informationWhen a student leaves this intensive 5 day class they will have hands on understanding and experience in Ethical Hacking.
Ethical Hacking and Countermeasures Course Description: This class will immerse the student into an interactive environment where they will be shown how to scan, test, hack and secure their own systems.
More informationEvolution Of Cyber Threats & Defense Approaches
Evolution Of Cyber Threats & Defense Approaches Antony Abraham IT Architect, Information Security, State Farm Kevin McIntyre Tech Lead, Information Security, State Farm Agenda About State Farm Evolution
More informationAdvanced Visibility. Moving Beyond a Log Centric View. Matthew Gardiner, RSA & Richard Nichols, RSA
Advanced Visibility Moving Beyond a Log Centric View Matthew Gardiner, RSA & Richard Nichols, RSA 1 Security is getting measurability worse Percent of breaches where time to compromise (red)/time to Discovery
More informationThe Leading Provider of Endpoint Security Solutions
The Leading Provider of Endpoint Security Solutions Innovative Policies to Defend Against Next-Generation Threats Conrad Herrmann CTO and Co-Founder Zone Labs, Inc. Network Security Is an Uphill Battle
More informationDYNAMIC DNS: DATA EXFILTRATION
DYNAMIC DNS: DATA EXFILTRATION RSA Visibility Reconnaissance Weaponization Delivery Exploitation Installation C2 Action WHAT IS DATA EXFILTRATION? One of the most common goals of malicious actors is to
More informationJUNIPER NETWORKS SPOTLIGHT SECURE THREAT INTELLIGENCE PLATFORM
JUNIPER NETWORKS SPOTLIGHT SECURE THREAT INTELLIGENCE PLATFORM May 2015 Nguyễn Tiến Đức ASEAN Security Specialist Agenda Modern Malware: State of the Industry Dynamic Threat Intelligence on the Firewall
More informationDescription: Course Details:
Course: Malicious Network Traffic Analysis Duration: 5 Day Hands-On Lab & Lecture Course Price: $ 3,495.00 Description: There are a tremendous amount of network based attacks to be aware of on the internet
More informationWhy Device Fingerprinting Provides Better Network Security than IP Blocking. How to transform the economics of hacking in your favor
Why Device Fingerprinting Provides Better Network Security than IP Blocking How to transform the economics of hacking in your favor Why Device Fingerprinting Provides Better Network Security than IP Blocking
More informationCyber security Time for a new paradigm. Stéphane Hurtaud Partner Information & Technology Risk Deloitte
Cyber security Time for a new paradigm Stéphane Hurtaud Partner Information & Technology Risk Deloitte 90 More than ever, cyberspace is a land of opportunity but also a dangerous world. As public and private
More informationThreat Intelligence: The More You Know the Less Damage They Can Do. Charles Kolodgy Research VP, Security Products
Threat Intelligence: The More You Know the Less Damage They Can Do Charles Kolodgy Research VP, Security Products IDC Visit us at IDC.com and follow us on Twitter: @IDC 2 Agenda Evolving Threat Environment
More informationThe Advanced Attack Challenge. Creating a Government Private Threat Intelligence Cloud
The Advanced Attack Challenge Creating a Government Private Threat Intelligence Cloud The Advanced Attack Challenge One of the most prominent and advanced threats to government networks is advanced delivery
More informationAnalytic and Predictive Modeling of Cyber Threat Entities J. Wesley Regian, Ph.D.
18th Annual Space & Missile Defense Symposium IAMD Evolution and Integration/Key Topic: Predictive Cyber Threat Analysis Analytic and Predictive Modeling of Cyber Threat Entities J. Wesley Regian, Ph.D.
More informationAnalyzing HTTP/HTTPS Traffic Logs
Advanced Threat Protection Automatic Traffic Log Analysis APTs, advanced malware and zero-day attacks are designed to evade conventional perimeter security defenses. Today, there is wide agreement that
More informationIncident Response. Six Best Practices for Managing Cyber Breaches. www.encase.com
Incident Response Six Best Practices for Managing Cyber Breaches www.encase.com What We ll Cover Your Challenges in Incident Response Six Best Practices for Managing a Cyber Breach In Depth: Best Practices
More informationSecurity Threat Kill Chain What log data would you need to identify an APT and perform forensic analysis?
Security Threat Kill Chain What log data would you need to identify an APT and perform forensic analysis? This paper presents a scenario in which an attacker attempts to hack into the internal network
More informationHow To Create An Insight Analysis For Cyber Security
IBM i2 Enterprise Insight Analysis for Cyber Analysis Protect your organization with cyber intelligence Highlights Quickly identify threats, threat actors and hidden connections with multidimensional analytics
More informationCybercrime myths, challenges and how to protect our business. Vladimir Kantchev Managing Partner Service Centrix
Cybercrime myths, challenges and how to protect our business Vladimir Kantchev Managing Partner Service Centrix Agenda Cybercrime today Sources and destinations of the attacks Breach techniques How to
More informationHow We're Getting Creamed
ed Attacks How We're Getting Creamed By Ed Skoudis June 9, 2011 ed Attacks - 2011 Ed Skoudis 1 $ cut -f5 -d: /etc/passwd grep -i skoudis Ed Skoudis Started infosec career at Bellcore in 1996 working for
More informationEMERGING THREATS & STRATEGIES FOR DEFENSE. Stephen Coty Chief Security Evangelist @StephenCoty
EMERGING THREATS & STRATEGIES FOR DEFENSE Stephen Coty Chief Security Evangelist @StephenCoty Industry Analysis 2014 Data Breaches - Ponemon Ponemon 2014 Data Breach Report *Statistics from 2013 Verizon
More informationAddressing the Full Attack Continuum: Before, During, and After an Attack. It s Time for a New Security Model
White Paper Addressing the Full Attack Continuum: Before, During, and After an Attack It s Time for a New Security Model Today s threat landscape is nothing like that of just 10 years ago. Simple attacks
More informationCyber Security. BDS PhantomWorks. Boeing Energy. Copyright 2011 Boeing. All rights reserved.
Cyber Security Automation of energy systems provides attack surfaces that previously did not exist Cyber attacks have matured from teenage hackers to organized crime to nation states Centralized control
More informationWhat s Wrong with Information Security Today? You are looking in the wrong places for the wrong things.
What s Wrong with Information Security Today? You are looking in the wrong places for the wrong things. AGENDA Current State of Information Security Data Breach Statics Data Breach Case Studies Why current
More informationAttacks from the Inside
Attacks from the Inside Eddy Willems, G Data Righard J. Zwienenberg, Norman Attacks from the Inside. Agenda - Social Networking / Engineering - Where are the threats coming from - Infection vectors - The
More informationGetting real about cyber threats: where are you headed?
Getting real about cyber threats: where are you headed? Energy, utilities and power generation companies that understand today s cyber threats will be in the best position to defeat them June 2011 At a
More informationWho s Doing the Hacking?
Who s Doing the Hacking? 1 HACKTIVISTS Although the term hacktivist refers to cyber attacks conducted in the name of political activism, this segment of the cyber threat spectrum covers everything from
More informationUnified Security, ATP and more
SYMANTEC Unified Security, ATP and more TAKE THE NEXT STEP Martin Werner PreSales Consultant, Symantec Switzerland AG MEET SWISS INFOSEC! 27.01.2016 Unified Security 2 Symantec Enterprise Security Users
More informationStop advanced targeted attacks, identify high risk users and control Insider Threats
TRITON AP-EMAIL Stop advanced targeted attacks, identify high risk users and control Insider Threats From socially engineered lures to targeted phishing, most large cyberattacks begin with email. As these
More informationCyber/IT Risk: Threat Intelligence Countering Advanced Adversaries Jeff Lunglhofer, Principal, Booz Allen. 14th Annual Risk Management Convention
Cyber/IT Risk: Threat Intelligence Countering Advanced Adversaries Jeff Lunglhofer, Principal, Booz Allen 14th Annual Risk Management Convention New York, New York March 13, 2013 Today s Presentation 1)
More informationThe Next Generation IPS
The Next Generation IPS Comprehensive Defense Against Advanced Persistent Threats Contents Introduction.............................................. 1 What Are Advanced Persistent Threats?.............................
More informationAdvanced Analytics For Real-Time Incident Response A REVIEW OF THREE KNOWN CASES AND THE IMPACT OF INVESTIGATIVE ANALYTICS
Advanced Analytics For Real-Time Incident Response A REVIEW OF THREE KNOWN CASES AND THE IMPACT OF INVESTIGATIVE ANALYTICS Introduction Every year, cyber criminals become stronger and more sophisticated
More informationSurviving the Ever Changing Threat Landscape
Surviving the Ever Changing Threat Landscape Kevin Jordan Cyber Security Specialist Dell GLBA FFIEC NCUA PCI HIPAA NERC CIP FISMA 700+ Percentage of U.S. adults who Federal named online and banking state
More information05 June 2015 A-000061-MW TLP: GREEN
05 June 2015 Alert Number A-000061-MW Please contact the FBI with any questions related to this FLASH Report at either your local Cyber Task Force or FBI CYWATCH. Email: cywatch@ic.fbi.gov Phone: 1-855-292-3937
More informationNetworking for Caribbean Development
Networking for Caribbean Development BELIZE NOV 2 NOV 6, 2015 w w w. c a r i b n o g. o r g N E T W O R K I N G F O R C A R I B B E A N D E V E L O P M E N T BELIZE NOV 2 NOV 6, 2015 w w w. c a r i b n
More information