Lessons From The Defensive Security Podcast @maliciouslink
I’m Jerry Bell Work @ IBM – I speak for myself only Podcast @ DefensiveSecuirty.org @maliciouslink
“ Those who cannot remember the past are condemned to repeat it. - George Santayana
I study how data breaches happen and talk about them on a podcast
Many opportunities to learn
As defenders, we have limited budget, limited time
As defenders, we have limited budget, limited time We must efficiently prioritize
There are many good industry reports that help explain breaches
Most reports segment breaches by attack type or motives of the adversary
Reports are helpful… But they do not explain what to fix.
What I’ve learned
Our people are the key to security
Our people are the key to security Let me explain…
Security researchers have grown adept at manipulating media coverage of vulnerabilities they found
The concept of “least privilege” is not well understood or implemented
Example: NotPetya
Supply chain is a significant emerging threat
Example: NotPetya, Target
IT architectures and software are more a form of individual artistic expression than principled engineering
“ Hackers only have to be right once… Defenders have to be right every time.
Attacks shift away from what no longer works to what does work
Attack techniques and tools are getting more complicated
Attack techniques and tools are getting more complicated But opportunistic attacks still work very well
The industry endlessly debates end-user security training
The industry endlessly debates end-user security training But rarely about training the people designing our IT systems
The debate about end user training is a red herring
Business leaders have little idea how much risk they are accepting
Our IT tools are being used against us
Cloud and automation create dramatic opportunities to mitigate risk… and also creates new risks
Indicators that a breach was underway are usually obvious… But only during forensic analysis
The entry point in nearly all breaches seems obvious… After the breach happened
Organizations are judged on their handling of a breach… Possibly more than having the breach
Organizations will have difficulty meeting breach reporting timeframes of new regulations
Security is a people problem… …and the problem start with IT and Security staff.
THANK YOU! @maliciouslink