Date post: | 27-May-2015 |
Category: |
Technology |
Upload: | tripwire |
View: | 786 times |
Download: | 0 times |
Five “Quick Wins” from Verizon’s 2013 Data Breach Investigation Report (DBIR)
OR…”HOW TO AVOID PARTICIPATING IN THE 2014 REPORT…”
MAY, 2013
5 “QUICK WINS” FROM VERIZON’S 2013 DATA BREACH INVESTIGATION REPORT (DBIR) OR…’HOW TO AVOID PARTICIPATING IN THE 2014 REPORT…”
Sales Executive Name and if desired, email/phone
3
“Verizon has been producing the Data Breach Investigations Report (DBIR) since 2008. This year its analysis covers more than 47,000 security incidents. Its scale is unparalleled.”
http://www.verizonenterprise.com/DBIR/2013/
4
Quick Win #1 - Address Credentials, Admin Privileges, and Password HygieneThe most significant short term action area
Applies to over 3/4ths of the breaches investigated
5
Quick Win #1 - Address Hardening Credentials, Admin Privileges, and Password HygieneSuggestions for CISOs -
Your team should be able to tell you and provide substantiative evidence on the following: What is your password policy and how compliant
Provide current metrics
Demonstrate trends
How many employees, rate of change
No perpetual accounts, hardened admin passwords
Any unused/inactive?
Trouble-ticket stats on password service
HR interlink for hired and departing employees
Consider employee security skills and awareness training
Assure you have highest level executive support
6
Quick Win #2 - Protect Key AssetsNew year, same song – no real improvement over 2011 data
66% of data exfiltrated was data “at rest” In servers and databases
Accessed via legitimate (though misused) credentials
Again – address hardening credentials, admin privileges, and password policy….
7
Quick Win #2 - Protect Key AssetsSuggestion for CISOs – What can your team tell you about….
Inventory lists for authorized/ unauthorized devices and software Location Asset criticality to the business
Patch (actual v. planned), and remediation (actual v. planned)
Assure all systems are configured for anti-malware: On insert/attach - disable auto-run content on
external devices
On insert/attach - Standard system configuration will run automatic anti-malware
8
Quick Win #3 – Prepare for AttackAttackers used low/very low-skill tactics Nearly 80% of the attacks are not sophisticated (DOH! They’re
misusing or stealing our credentials….)
9
Quick Win #3 – Prepare for AttackAddress the most common attack vectors Aside from Physical (largely ATM and POS devices) #1 Hacking – 40 varieties, 94% are 5 hacks #2 Malware – phishing via email with malware payload, then
75% install a keylogger #3 Aided by social / networking – spear phishing
10
Quick Win #3 – Prepare for Attack5 Hacks account for 94% “…easiest and least-detectable way to gain unauthorized
access is to leverage authorized access….authentication-based attacks (guessing, cracking, or reusing valid credentials) factored into about 4 of every five breaches involving hacking…” – 2013 DBIR
11
Quick Win #3 – Prepare for AttackSuggestions for CISOs Create a security awareness and skills campaign for all
employees and/or users if appropriate
12
Quick Win #4 – Detect and Contain EarlyTimespan of Events Overall
Breach• 24% secs/mins• 73% hrs/days (of these,60%hrs)
Data Exfiltration
• 23%secs/mins• 36% in hrs Discovery
• 95% up to months
Containment• 60% hrs/days• 35% weeksyears
13
Quick Win #4 – Detect and Contain EarlySuggestions for CISOs –
Being breached is inevitable….-DBIR Keep emphasizing prevention Focus resources on detection and containment Start with a risk assessment – know your status Join a collaborating group for alerts and details on current
and new attacks Have formalized and tested Breach Response procedures Know when to call the police or others
Discovery• 95% up to months
Containment• 60% hrs/days• 35% weeksyears
14
Quick Win #5 – Choose and Implement a Security FrameworkSuggestions for CISOs – SANS 20 Critical Security Controls (CSC) – recommended by
Verizon’s Data Breach Investigations Report NIST SP 800-53 (government oriented) ISO/IEC 27002 (process oriented) Cool things about SANS:
Developed by a consortium of experts, widely collaborated upon, maintained and updated for evolving conditions
Appropriate, actionable, and flexible for any org, maturity level, industry, budget, or likely attack vectors
Prioritized controls and sub-controls
Provides implementation guidance, test tools, automation procedures, etc
Indicates where NIST overlaps, and how NSA ranks the controls
15
Foundational Security from Tripwire
Risk-based security & compliance management Broadest set of foundational security controls
Focused on the “first four” SANS 20; Cover 16 of 20 in total
Security business intelligence with performance reporting and visualization to make better decisions
16
Tripwire Solutions
17
OR MAYBE THE NEXT ONE?
18
Integrated Security Solutions: A SANS 20 CSC View