Adversary Defense: Past, Present, Future Presenter’s Name Here Presenter’s Title Here

Is compromise inevitable? Adversary Defense: Past, Present, Future It’s going to happen… Offense is cheaper and easier than Defense. Compromise is no longer if, but when. Detection takes too long The average number of days to discover a breach Response times impact the business Average response times are weeks to months Not enough skills 70% of organizations lack staff to counter cyber security threats “By 2020, 60% of enterprise information security budgets will be allocated for rapid detection and response approaches, up from less than 10% in 2013.” - Gartner “By 2020, 60% of enterprise information security budgets will be allocated for rapid detection and response approaches, up from less than 10% in 2013.” - Gartner

Are all “Incidents” the same? Public Data Breach Suspected Compromise Malware Outbreaks & Employee Investigations Adversary Defense: Past, Present, Future

Proactive or Reactive? Experiencing a security incident Internal teams unable to address issue at hand Pressure to resolve the incident quickly Need to address legal/compliance reporting requirements post-incident Currently battling an incident and need extra help Media coverage of breach Crisis Mode Realization that gaps in security may have led to an undetected breach Industry peer suffered a breach and they want to know if they have been impacted New security alert or intelligence that causes concern and the customer has no way to determine if they might be impacted Elevated Concern Looking to turn plans into optimized programs Looking for ways to improve or augment internal IR capabilities Want to pre-negotiate terms and rates for faster action when 3 rd party help is needed Have a regulatory or legal requirement to have a 3 rd - party IR team on retainer Proactive Planning Adversary Defense: Past, Present, Future

5 5 Planning Horizon Reliability Source: Gartner Research, How to Select a Threat Intelligence Service, Informed Judgment High Degree of Certainty Operational Intelligence Network Traffic Feed Strategic Intelligence ImmediateLong Term Snake Oil Security Intelligence

Adversary Intelligence Adversary Defense: Past, Present, Future Adversary Actor Group TTP Actions Resources Campaigns Victims Trends Incidents Indicators Intent Attack Vector Vulnerabilities Exploits Targets Industry Geography CollectionProcessingAnalysis Production Data Warehouse Mining Social Network Mining Underground Forums Open Source Monitoring Information Sharing Subscription Consumption Content Capabilities Technical Analysis Directed Research Telemetry

Incident Response Today Adversary Defense: Past, Present, Future Un-prioritized AlertsManual IR Call TreesTriage Begins External Response Team CalledDelays in Ramp-upManual Correlation of Evidence

Incident Response Tomorrow Adversary Defense: Past, Present, Future Prioritized/Correlated AlertsAutomated Triage WorkflowCollaborative Triage Clear Line of SiteReal-time updatesCollaborative Response Improve Response Times 1 Lower Response Costs 2 Improve Response Effectiveness 3 Enable Continuous Improvement 4

Adversary Techniques +91 % Increase in targeted attack campaigns Adversary Defense: Past, Present, Future

Spear Phishing Adversary Defense: Past, Present, Future

Spear Phishing with an Attachment More than 50 percent of attachments used in spear phishing attacks were executable files in 2013.

Risk of Being Targeted by Job Role Personal Assistant (Executive Assistant) High Medium Low Media Senior Management Sales C-Level Recruitment R&D Risk Risk of Job Role Impact by Targeted Attack Sent by Spear-Phishing Source: Symantec Adversary Defense: Past, Present, Future

Targeted Attack Campaigns per Campaign Recipient/Campaign Campaigns Duration of Campaign days 3 days8.3 days Adversary Defense: Past, Present, Future

Targeted Organization by Size Spear Phishing Attacks by Size of Targeted Organization, Source: Symantec 50% 39% 18% 31% 30% 100% ,501 to 2,500 1,001 to 1, to 1, to to 250 2,501+ Employees 50% 61% Adversary Defense: Past, Present, Future

In operation since at least 2011 Appear to be operating in the UTC +4 time zone suggesting a base of operations working in the Moscow Russia time zone Initially targeted defense and aviation companies in the US and Canada Shifted focus to US and European energy firms in early 2013 Likely to either be state sponsored, or corporate sponsored (given the type of victims targted) Involvement with Russian crime scene/forums (confirmed) – Backdoor.Oldrea – Trojan.Karagany Data theft The Dragonfly group

Dragonfly Group - Attack Methods Adversary Defense: Past, Present, Future Send an to a person of interest Spear Phishing Infect a website and lie in wait for them Watering Hole Attack

Dragonfly Malware Threats Adversary Defense: Past, Present, Future Trojan.Karagany From leaked source code Sold in underground market Leaked in 2010 Modified by Dragonfly team Features include collecting passwords, taking screenshots, cataloging documents Backdoor.Oldrea a.k.a. Havex, Energetic Bear RAT Custom malware Used in majority of attacks Acts as backdoor for attackers Features include collecting system information, Outlook address book Symantec Antivirus Backdoor.Oldrea Trojan.Karagany

Dragonfly Exploit Kits Adversary Defense: Past, Present, Future Lightsout Exploit Kit Uses Java and IE exploits Injected iframe link sends victim to website hosting malware Hello Exploit Kit Uses Javascript to fingerprint system and determine best exploit Intrusion Prevention Signatures Web Attack: Lightsout Exploit Kit Web Attack: Lightsout Toolkit Website 4

Cyber Security Services Prepare Attack Readiness Assessment IR Plan Assessment IR Program Development TableTop Exercises Cyber Exercises and Simulation Detect Data Collection Correlation Analysis Monitoring Services Alerting Services Respond Incident Investigation Incident Containment Incident Recovery Lessons Learned Inform Adversary Intelligence / Data Feeds / Directed Research

Thank you! Copyright © 2014 Symantec Corporation. All rights reserved. Symantec and the Symantec Logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners. This document is provided for informational purposes only and is not intended as advertising. All warranties relating to the information in this document, either express or implied, are disclaimed to the maximum extent allowed by law. The information in this document is subject to change without notice. Thank you! symantec.com/threatreport Adversary Defense: Past, Present, Future