Gregg Gerber. Strategic Engagement, Emerging Markets

Transcription

1 Government of Mauritius Gregg Gerber Strategic Engagement, Emerging Markets

2 2

3 (Advanced) Persistent Targeted attacks Time

4 Era of Discovery Era of Transition Era of Fame & Glory Present Era of Mass Cybercrime Vision & Security Solution Strategy - Confidential 4

5 Attackers Malicious Outsiders State Nation Government Sponsored Hack-tivists Hacking for a Cause Insiders Malicious and Non-Malicious Cyber Criminals Hacking for Profit Vision & Security Solution Strategy - Confidential 5

6 APT Attacker (Malicious Outsider) Insider (Malicious and Non-malicious) Hack-tivist Cyber Criminals State Nation RECON Free Scanners Insider Knowledge Social Networks / Google Data Mining Espionage / Collusion INCURSION Basic Scripts /MetaSploit Privileged Access Social Engineering Attack Kits / Malcode / Bots / Affiliates Tailored Malcode / 0-Day DISCOVERY Random Targeting Asset Awareness Targets of Chance Targets of Chance / Choice Targets of Choice CAPTURE Visible / Low Value Critical Assets Media Worthy Asset or Access Monetized Assets High Value IP / Government Secrets EXFILTRATE Tagging and Damage Theft and Damage DDoS, Theft and Damage Fraud and Financial Gain Gain / Maintain Strategic Advantage Vision & Security Solution Strategy - Confidential 6

7 Strategy Rethink: Anatomy of an attack 1. Research 2. Incursion 3. Discovery 4. Capture 5. Exfiltrate Risk Posture and Policies Strong security awareness, counter intelligence Continuous enforcement of controls according to risk policy (mgmt and protection) Actively monitor infrastructure (endpoint to perimeter), information and users Control unusual internal movement and access of sensitive data Counter intelligence, forensics, damage mitigations and information recovery 7

8 IT Security pressures changing world User demands - Social Networking - Fav technology Time - to enable - to respond Reduce costs Information - Supply chain - De-perimeterisation New Tech adoption Governance Compliance Security Complexity (More controls) Threats - Volume - Type

9 Where Does Your Threat Intelligence Reside? Internal Targeted Attacks Are meant specific organizations They re not seen at a global level, Symantec can provide researcher-level tools & local assistance to help you detect and prevent these types of attacks Global Intelligence Network Like-minded organizations can share intelligence to help peers, some industries and agencies are not able to for National Security Reasons External 9

10 Symantec Cyber Threat Intelligence Cyber Awareness Cyber Briefing Center Strategist Advisories Cyber Risk Assessments Cyber Training Cyber Readiness Assessments Cyber Preparedness Security Base lining Threat Intelligence Reports Reputation Analysis Business Risk Modeling Cyber Forensics Security Base lining Incident & Event Management Threat Analysis & Response Threat Impact Assessment Cyber Response Product & Threat Analysis Support Cyber Incident Advice Cyber Threat Response Scribe January 3, 2013

11 What Makes Symantec Unique? 2 Million URLs 6.3 Billion Files 1.5 Million Machines Leaders in Threat Research & Technology The Biggest Organisations Trust our People & Services Provide Risk-Based Perspective Market Validation 11

12 Symantec Cyber Threat Intelligence Summary Government Engagement Security Intelligence Group Highly Targeted Threat Analysis Leverage Existing Investments Cyber Readiness Programs Participation in National Cyber Strategies Our Global Intelligence Network and Reputation Feeds add Threat Context to YOUR Infrastructure The Symantec s Threat Analysis Tools Used by Our Researchers Are Also Available to You to Analyze Highly Targeted Attacks Our Modular Approach means we can Leverage Investments in Your Existing Security Controls, and Demonstrate Where to allocate resources With Risk Modeling We Help you understand YOUR risks and Prepare for Cyber Threats

13 Attack Scenarios Economically motivated steal money/info to resell 17 th century privateering and modern cybercrime Link between crime and national security actors 13

14 Targets - Depend on the objective of the attacker Consumers Small Business Large Business Trusted Stepping Stone / Economic IPR / Economic / Espionage CII Operators Defense Government Economic / Intel / Warfare / Political Intel / Warfare / Political Economic / Intel / Warfare / Political 14

15 Modus operandi Because there is no patch for stupidity Social Engineering Unique Malware Mass Scale Targeted APT Democratization of Malware 15

16 Modus operandi Value of Information Jumping the Air Gap SCADA Zero-Day Vulnerabilities Smart Grid OS Intelligence 16

17 Specifically on defense 5th Domain of Warfare Land Sea Air Space Cyber Merge of EW and SIGINT with cyber Bletchley Park Codebreaker 17

18 Specifically on defense Makes sense from a military point of view Sensors, communications and robotics technologies dominating future battlefield 18

19 Specifically on defense Historically listen to information & deny access to information New paradigms include modifying information to create a false operational picture and damage the infrastructure, or remotely control it 19

20 Cyber Awareness Strategist Cyber Advisories Summary business reports defining best practices for mitigating the attack Cyber Training Cyber threat detection and incident response course (10day) Cyber Briefing Center Briefing on the latest threats, Understand the processes and techniques required to deal with today s cyber attacks Cyber Risk Assessments Information risk assessments, cyber security policy assessments Cyber Readiness Join in Symantec s Cyber war games to test and develop your skills and capability 20

21 Cyber Preparedness Security Base Lining Threat Intelligence Feeds & Reports Business Risk Modeling Define/validate the state of your environment & security controls Map & validate potential risks to the business & Apply controls Define/validate the state of your environment & security controls CCS Policy/Assessment Mgr. Altiris SEP/CSP Cyber V Assessments Enterprise Security Assessment CCS Vulnerability Mgr. DeepSight Feeds Reputation Feeds Threat Analyst service Vulnerability assessment CCS Risk Manager SPC Business Continuity Planning service * 21

22 Cyber Response Business Critical Services Cyber Incident Advisory Malware Research Cyber Threat Response Product and threat analysis support Symantec strategists help drive response process and provide business guidance Symantec Partners provide on-site expertise including forensics and other technical capabilities 24x7 Access Personalized Priority Access to Strategists Trusted Partner Ecosystem Scribe 22

23 Cyber Forensics In-Progress & Post Incident Security Base Lining (Re) Define/validate the state of your environment & security controls Incident/Event Management Malware Research Gather logs & event data to identify anomalous behavior Threat Analysis & Response (Technical) Identify and quantify new attacks, define and apply technical responses Threat Impact Assessment (Business) Identify the threat genealogy to assess threat actor and motives. Define potential business impact CCS Policy/Assessme nt Mgr. Altiris SEP/CSP Cyber V Assessments Enterprise Security Assessment Managed Security Services SSIM DeepSight Feeds SIM design & optimization Threat Analyst Non-classified Reputation Feeds STAR BCS - Scribe Classified Smart Harness Threat Expert Security cleared Threat Analysis Non-classified Reputation Feeds DeepSight Feeds Threat Analyst Classified Reputation Feeds Data Cache DeepSight Feeds Security cleared Threat Analyst 23

24 Symantec Cyber Lifecycle Offering Cyber Awareness Cyber Preparedness Strategist Advisories Cyber Risk Assessments Cyber Training Cyber Readiness Security Base Lining Threat Intelligence Feeds & Reports Business Risk Modeling Cyber SOC Tour Threat Impact Assessment Threat Analysis & Response Incident & Event Mgmt. Security Base Lining Cyber Threat Response Cyber Incident Advice BCS Cyber Forensics Cyber Response

25 Thank You Gregg