1. FROM SECURITY DATA TO SECURITY INTELLIGENCE ZULFIKAR RAMZAN, CTO, RSA

2. 2 Paper Towns and Cybersecurity @zulfikar_ramzan

3. 3 What Came First: the Map or the Town? @zulfikar_ramzan

4. 4

5. 0 010110100 101100111010011 110100110 11 0 010110100 101100111010011 110100110 11 0 010110100 101100111010011 110100110 11WALLS TALLER WON’T SOLVE OUR PROBLEM

6. 6 Attacks are targeted (e.g., via repeated use of polymorphism and metamorphism); Macro-distribution supplanted by micro-distribution. Powerful attack toolkits available w/ tiered pricing, 24x7 customer support. Ecosystem for buying and selling tools and cybercriminal services democratizes advanced attacks Why Intrusions Are Successful Why are intrusions successful? @zulfikar_ramzan

7. 7 1 23 Visibility Identity Risk Three Strategic Pillars @zulfikar_ramzan

8. 8 is the foundation for mitigating the risk of advanced threats visibility If you really want to protect your network, you really have to know your network. You have to know the devices, the security technologies, and the things inside it. -Rob Joyce, NSA TAO Chief, Usenix Enigma 2016 @zulfikar_ramzan

9. 9 Cloud Key Visibility Points Logs NetflowPackets Endpoints Identities @zulfikar_ramzan

10. 10 12 TIME Attack Identified Response Advanced Attacks: Where to Focus 1 TARGETED SPECIFIC OBJECTIVE STEALTHY LOW AND SLOW 23 INTERACTIVE HUMAN INVOLVEMENT @zulfikar_ramzan

11. 11 identity is foundational and will matter even more as the threat landscape evolves @zulfikar_ramzan

12. 12 Advanced breaches don’t have to involve malware: SQL Injection -> Web Shell -> RDP Advanced breaches can be very simple – e.g., credential theft Every breach involves co-opting of identity (authentication isn’t the same as identity assurance) Malware Reality Check @zulfikar_ramzan

13. 13 Identity is More Than Authentication Governance Access / Auth Lifecycle Assurance @zulfikar_ramzan

14. 14 embrace and own your risk Supply chain risk Financial risk Operational risk IT Security risk Physical risk Currency fluctuation risk Regulatory risk @zulfikar_ramzan

15. 15 How we spend Prevention 80% Monitoring 15% Response 5% Prevention 80% Monitoring 15% Response 5% Prevention 33% How we should spend Monitoring 33% Response 33% Shift Priorities and Capabilities @zulfikar_ramzan

16. 16 Takeaways We need pervasive and true visibility Identity and authentication matter even more Embrace and own your risk 1 1 2 2 3 3 @zulfikar_ramzan

17. 17 Thank You