2. Pharming > 50% of all PCs compromised Application Attacks BotArmies/DDOS 2 Organized Cyber-crime Ecosystem Hacktivism Cyber Terrorism Phishing Identity Theft OS Hacking BotNets/DDOS Cyber Criminals Script Kiddies Nothing short of game-change innovation can stem this rising tide Seems everything changes, everyday

4. Needs a good home

5. “Estonia Sending Cyber Defense Experts to Georgia” Network World

6. MOST SECURITY TECHNOLOGY PROVIDERS HAVE A NARROW PERSPECTIVE OF THE CYBER - SECURITY LANDSCAPE

7. U NFORTUNATELY THE R EALITY OF THE CYBER SECURITY LANDSCAPE IS SOMEWHAT LARGER

8.  T HREATS ARE ESCALATING AT AN ALARMING RATE  P UBLIC POLICY HAS GENERALLY FAILED US  G OVERNMENT ACTION HAS BEEN INADEQUATE  M EDIA / PUBLIC IS AT BEST CONFUSED ABOUT CYBER THREATS  T ECHNOLOGY HAS PROVIDED LITTLE MORE THAN A BAND - AID  M ANY BELIEVE CYBER - CRIMINALS HAVE ALMOST MYSTICAL POWERS

9. M OST C YBER - SECURITY CONVENTIONAL WISDOM ATTEMPTS TO MODEL OUR CYBER DEFENSES BASED ON TRADITIONAL DEFENSE IN DEPTH IMPLEMENTATIONS Calsten Fortress c. 1600’s, Marstrand, Sweden

10. The digital warrior

11. Where:  80%+ of all successful cyber-attacks exploit vulnerabilities in four categories; none require rocket science to fix  Input validation, poor coding technique – business logic, authentication and access control, device hardening – patching, secure baselines  Building in security is 60 times less expensive that bolting-on later  Up-level security in SDLC We must develop:  Strong vulnerability management program  Assessment and remediation of legacy code used in operating systems and applications  Assessment and remediation of web site vulnerabilities  This will continue to be the most sought-after attack vectors by criminals to host links to phishing and identity theft code.  Assessment and remediation third party code and widgets  An attractive attack vector  Demonstrated by the “Secret Crush” malware that posed as a Facebook widget to install itself on about 1 million PCs in late 2007 and early 2008

12. Where:  Complex systems fail complexly, it is not possible to anticipate all the failure modes  Complexity provides both opportunity and hiding places for attackers  Damping out complexity is impossible when coupled with change, growth and innovation  Security failures are inevitable We Must Develop:  Robust incident management integrating all aspects of business (e.g. communications, development, legal)  Security SME throughout the SDLC  Deploy analytical tools to continually assess the security of development and the infrastructure  Provide security training to development and infrastructure teams

13. If:  A successful attack is inevitable Then we must develop:  A thorough understanding of the business, key business assets and critical functionality  Define defensible perimeters  Expanded firewall and IPS footprint  Develop/understanding network choke-points  Bandwidth allocation  Dynamic re-configuration

14. Where:  You can’t live without it!  “Run from monoculture in the name of survivability” – Dan Geer We must develop:  Multiple tools for detection and analysis  Multiple mitigation methods  Segmentation for everything  New thinking – situational awareness – attack simulation…

15. Where:  Every cyber criminal is our next door neighbor  We can never retreat to a safe neighborhood We must develop:  The ability to defend knowing the current threat profile, generally and specifically to us.  Encryption for everything moving in our networks  Defensive applications coding  More important than ever with 3 rd party software

16. Where :  Cyber criminals are attacking transaction streams  Transaction attacks are extremely difficult to detect We must develop:  Protect data  Protect the transactions  Employee exfiltration blocking

17.  May be averting a crises, but not getting in front of the problem

18.  Innovating for impact  Incremental  Sustaining core and context  Radical

19. Where:  Attacks are becoming much more subtle  Attacks are using multiple channels

20. If you are not moving forward you are falling behind…status quo is unacceptable Nothing is stable Surprise is constant We work at a permanent, structural disadvantage compared to our attackers

22. Yogi Berra