1. Why we keep doing security wrong Grant Cohoe

2. About Me System Administrator – RSA (The security division of EMC) OpComm Director / Sysadmin / Chairman – Computer Science House @ RIT ISTS Team OpComm (“Team Uptime”) – 3 rd place 2011, 2 nd place 2012

3. What we do Rely on perimeter defenses Overlook the most vulnerable Security is an achievement

4. PERIMETER DEFENSES “Shields are up captain!”

5. Perimeter Defenses Firewalls NAT Proxies IPS

6. Firewalls Host-based – Windows Firewall, iptables, pf – Drill holes! – No one filters outbound traffic

7. Firewalls Network-based – Cisco ASA/PIX, CheckPoint Gateway, etc – Drill less holes, but worse ones Example: SSH

8. Firewalls Great for the majority of badness Wont stop the real badness

9. NAT Non-routable private IP addresses No one can get to you directly? – WRAUNG! – Example: Adjacent Router

10. Proxies Traffic interception/filtering Not particularly useful Hostname vs IP blocking

11. IPS Look for malicious activity and stop it – What/who defines “malicious”? Often very specific targets

12. Perimeter Defenses Very Static Bypassable Good for the 99%, not for the 1

13. OVERLOOK THE MOST VULNERABLE “No one will ever attack this”

14. VoIP Phones Rely on a trusted network infrastructure Do little to no verification of configuration Desktop bugging devices

15. Printers Rarely segregated (dedicated printer network) Bad software No firewalls Springboard for more advanced attack

16. Home Gateways Terrible software

17. SECURITY IS NOT AN ACHIEVEMENT “One does not simply become secure”

18. Achievement “Make us secure”

19. Achievement High CapEx – Equipment, infrastructure Low resources to monitor – No SOC monkeys, investigators Even less to respond – In a crisis, you can’t move

20. Process Continuously monitor and respond to issues

21. Process Moderate CapEx – Different equipment, infrastructure Moderate resources to monitor – 24/7 staffed SOC w/ investigators Moderate resources to response – System management tools, live network mapping, etc

22. SECURITY ANALYTICS Cloud, big data, buzzword, buzzword

23. Security Analytics Real-time holistic intelligence platform Gather data from many sources Compare against profiles Replay entire sessions and content

24. Security Analytics Making available data accessible

25. Security Analytics As things happen, log them – Wireshark everything and store it – Server logs – Active Directory events If anything seems weird, analyze it

26. Profiles Old-and-busted approach: – Someone is trying to get into Oracle New hotness approach: – Josh is authenticated to the VPN – Jeff is authenticated to AD – Nick is trying to get into Oracle

27. Session Replay Server access logs tell you when something happened Wireshark lets you replay the network traffic Get the badness into a secured environment Poke at it

28. Security Analytics Analysis and response in minutes – Rather than days

29. Summary Don’t rely solely on perimeter defenses Don’t overlook anything no matter how small Security is a process, not an achievement Security analytics should be a thing

30. Contact Web: http://grantcohoe.com Twitter: @grantcohoe