1. Bluehat 2014 Looking back and driving forward Chris Betz Senior Director Microsoft Security Response Center

2. Investigate Vulnerability Reports Address vulnerabilities before they affect users secure@Microsoft.com Lead Security & Privacy Response Company-wide response process Cross-community Engagement Partner with security industry and CERTs Create community with vulnerability finders Security Technology Capabilities that improve security, detections and response for our customers

4. A recap

8. A recap - Ransomware

12. Use-after-free UEFI and device security Post-exploitation & persistence Sandboxes Botnets Security technology and vulnerabilities

13. Threat Intelligence Privacy and Security Credential Theft Vulnerability-free exploitation Big data for security Defending the cloud The Defense Dialog

14. Beyond Protection

15. Defender must defend entire attack surface Attacker must find (or make) one gap Defenses, defense-in- depth, resilience, detections, and response all reduce attack surface or limit damage Attacker’s asymmetry

16. Attackers advantage is a simplification – perhaps an oversimplification Mostly true at the engagement level We are focusing at wrong level of conflict Think campaign not engagement Hanging together “We must, indeed, all hang together or, most assuredly, we shall all hang separately.” – Benjamin Franklin

17. A campaign isn’t a single target – attackers reuse resources and rely on secrecy An attacker’s success depends on their ability to keep defenders from detecting and defeating their campaign. Defenders take one gap in a defenders secrecy to detect, illuminate, and defeat an adversary. When defenders share and act on intelligence it can take only one slip in secrecy to defeat an attacker’s campaign. Defenders’ advantage http://sopadepato.com/wordpress/wp-content/uploads/2013/01/Chewbacca.jpg

18. An attacker’s campaign Campaign types Opportunistic Regional target set Specific target set Single target CapabilitiesInfrastructureOperationsOpportunity Cost per targetAmount of Reuse

19. Campaign types Opportunistic Regional target set Specific target set Single target CapabilitiesInfrastructureOperationsOpportunity Cost per target Traditional defense – affect on campaign * Defense affects all adversaries

20. Campaign types Opportunistic Regional target set Specific target set Single target CapabilitiesInfrastructureOperationsOpportunity Cost per target Acting on Threat Intel – campaign impact * Defense affects targeted adversary

22. If we needed a reminder – there’s no replacement for consistent secure development and operations Requirements Design Development Verification Response to vulnerabilities is critical Secure Development and Operations

23. Protect, Detect, Respond Threat intelligence Cooperative defense Automated machine speed sharing Privacy and credentials Services and defense networks High security enclaves Not just devices, software, or services Beyond Exploitation