Date post: | 28-Jan-2018 |
Category: |
Software |
Upload: | f-secure-corporation |
View: | 231 times |
Download: | 1 times |
GOT HACKED?IT’S TOO LATE TO RUN NOW.
Janne Kauhanen
Twitter: @JKauhanen
360°OF CYBER SECURITY
2
MINIMIZE ATTACK SURFACE
PREVENT INCIDENTS
UNDERSTAND YOUR RISK, KNOW YOUR ATTACK SURFACE,
UNCOVER WEAK SPOTS
REACT TO BREACHES, MITIGATE THE DAMAGE,
ANALYZE AND LEARN
RECOGNIZE INCIDENTS AND THREATS, ISOLATE AND CONTAIN THEM
AGENDA
3
Definitions
Threat detection, a short summary
Why do you get hacked?
What to do when you get hacked?
Incident Response process
Forensics
Incident Response capabilities you should (and shouldn’t) have
Crisis management
SECURITY INCIDENTS
Hacker actions
4
Information leak Widespread malware infection
Internal misbehavior
(unintentional included)
"A SECURITY INCIDENT IS ANY KIND OF ACTION
THAT RESULTS IN A CHANGETO A KNOWN GOOD STATE.“
KURTHAGERMAN, CISO, ARMOR DEFENSE INC.
5
THE DOS AND DON’TS OF THREAT DETECTION
RECAP OF WEBINAR #3
6
WHY DID I GET HACKED?
7
"DRIVE BY" & SCRIPT KIDDIES
FOCUS
SKILL
TARGETED ATTACKS
IDENTITY THEFT, 0DAY
EXPLOITS
ADVANCED PERSISTENT
THREATS
INCIDENT RESPONSE PROCESS
16
Briefing Identification Containment Recovery Aftermath
INCIDENT RESPONSE PROCESS
17
Briefing Identification Containment Recovery Aftermath
INCIDENT RESPONSE PROCESS
18
Briefing Identification Containment Recovery Aftermath
INCIDENT RESPONSE PROCESS
19
Briefing Identification Containment Recovery Aftermath
INCIDENT RESPONSE PROCESS
20
Briefing Identification Containment Recovery Aftermath
FORENSIC INVESTIGATION
1. HOW WAS THE DEVICE BREACHED?‒ WHAT WAS THE ROOT CAUSE?
2. HOW DID THE ATTACKER COMMUNICATE WITH THE DEVICE?‒ IS THE ATTACKER STILL ABLE TO COMMUNICATE WITH THE DEVICE?
3. WAS THE ATTACKER ABLE TO MOVE BEYOND THIS DEVICE?‒ IS THERE A WAY TO DETECT INFECTED DEVICES?
4. WAS DATA EXFILTRATED FROM THE DEVICE?‒ HOW MUCH DATA, WHAT KIND OF DATA, AND WHERE DID IT GO?
21
FORENSIC INVESTIGATION
1. HOW WAS THE DEVICE BREACHED?‒ WHAT WAS THE ROOT CAUSE?
2. HOW DID THE ATTACKER COMMUNICATE WITH THE DEVICE?‒ IS THE ATTACKER STILL ABLE TO COMMUNICATE WITH THE DEVICE?
3. WAS THE ATTACKER ABLE TO MOVE BEYOND THIS DEVICE?‒ IS THERE A WAY TO DETECT INFECTED DEVICES?
4. WAS DATA EXFILTRATED FROM THE DEVICE?‒ HOW MUCH DATA, WHAT KIND OF DATA, AND WHERE DID IT GO?
22
FORENSIC INVESTIGATION
1. HOW WAS THE DEVICE BREACHED?‒ WHAT WAS THE ROOT CAUSE?
2. HOW DID THE ATTACKER COMMUNICATE WITH THE DEVICE?‒ IS THE ATTACKER STILL ABLE TO COMMUNICATE WITH THE DEVICE?
3. WAS THE ATTACKER ABLE TO MOVE BEYOND THIS DEVICE?‒ IS THERE A WAY TO DETECT INFECTED DEVICES?
4. WAS DATA EXFILTRATED FROM THE DEVICE?‒ HOW MUCH DATA, WHAT KIND OF DATA, AND WHERE DID IT GO?
23
FORENSIC INVESTIGATION
1. HOW WAS THE DEVICE BREACHED?‒ WHAT WAS THE ROOT CAUSE?
2. HOW DID THE ATTACKER COMMUNICATE WITH THE DEVICE?‒ IS THE ATTACKER STILL ABLE TO COMMUNICATE WITH THE DEVICE?
3. WAS THE ATTACKER ABLE TO MOVE BEYOND THIS DEVICE?‒ IS THERE A WAY TO DETECT INFECTED DEVICES?
4. WAS DATA EXFILTRATED FROM THE DEVICE?‒ HOW MUCH DATA, WHAT KIND OF DATA, AND WHERE DID IT GO?
24
FORENSIC INVESTIGATION
1. HOW WAS THE DEVICE BREACHED?‒ WHAT WAS THE ROOT CAUSE?
2. HOW DID THE ATTACKER COMMUNICATE WITH THE DEVICE?‒ IS THE ATTACKER STILL ABLE TO COMMUNICATE WITH THE DEVICE?
3. WAS THE ATTACKER ABLE TO MOVE BEYOND THIS DEVICE?‒ IS THERE A WAY TO DETECT INFECTED DEVICES?
4. WAS DATA EXFILTRATED FROM THE DEVICE?‒ HOW MUCH DATA, WHAT KIND OF DATA, AND WHERE DID IT GO?
25
IN-HOUSE CAPABILITIES
26
What kind of capabilities should I
have in-house?
Is there anything I should not try to do myself?
“BY FAILING TO PREPARE YOU ARE PREPARING TO FAIL”
BENJAMIN FRANKLIN
27
Scenarios based on real life, adjusted to target organization
GameMaster monitors actions and generates additional inputs
28
CRISIS MANAGEMENT EXERCISE
THERE ARE TWO TYPES OF COMPANIES:
THOSE WHO HAVE BEEN BREACHED, AND THOSE WHO
DON’T KNOW IT YET.
29
Q&A
30