Gartner UK 2015 Anatomy of An Attack

30
Anatomy of an Attack Wolfgang Kandek, Qualys [email protected] @wkandek 14-September-2015

Transcript of Gartner UK 2015 Anatomy of An Attack

Page 1: Gartner UK 2015 Anatomy of An Attack

Anatomy of an Attack

Wolfgang Kandek, [email protected]

@wkandek 14-September-2015

Page 2: Gartner UK 2015 Anatomy of An Attack
Page 3: Gartner UK 2015 Anatomy of An Attack

Verizon Data Breach Investigation Report

Page 4: Gartner UK 2015 Anatomy of An Attack

Verizon Data Breach Investigation Report

Page 5: Gartner UK 2015 Anatomy of An Attack

2122 Data Breaches

Page 6: Gartner UK 2015 Anatomy of An Attack

2122 Data BreachesFinancial data, Product data,

Personal data, Usernames/Passwords

Page 7: Gartner UK 2015 Anatomy of An Attack

Vulnerabilities

Page 8: Gartner UK 2015 Anatomy of An Attack

> 99% over 1 year old

Page 9: Gartner UK 2015 Anatomy of An Attack

> 99%

Page 10: Gartner UK 2015 Anatomy of An Attack

But 40 in 2014

Page 11: Gartner UK 2015 Anatomy of An Attack

But 40 in 2014and 50% within 2 weeks

Page 12: Gartner UK 2015 Anatomy of An Attack

> 99%

Page 13: Gartner UK 2015 Anatomy of An Attack

MalwareInfects

Computer

Exploit for known

Vulnerability

TargetedE-mailSpear

Phishing

Social MediaProfile

Exploit for 0-day

Vulnerability

KnownWorm/Virus

InfectedUSBDrive

Find infected

Computers

Command and Control

Username/Passwords

Dataloss

Brand

Finance

Others

Page 14: Gartner UK 2015 Anatomy of An Attack

> 99%

Page 15: Gartner UK 2015 Anatomy of An Attack

1. CTO (punk rock fan), punk rock concert offer, doc opened, no run2. Employee, employment offer, doc opened, script ran

3. COO (Greek History), article comment, doc not opened4. Employee, inquiry on side project, doc not opened

5. Employee, survey form of past employment, doc opened, infected, but no privileged account

6. System Admin, professional society membership offer, doc opened, infected - Bingo

Page 16: Gartner UK 2015 Anatomy of An Attack

Demo

Page 17: Gartner UK 2015 Anatomy of An Attack

PhishingTraining

Page 18: Gartner UK 2015 Anatomy of An Attack

PhishingTraining

10%->2%

Page 19: Gartner UK 2015 Anatomy of An Attack

VulnerabilitiesPatch

Page 20: Gartner UK 2015 Anatomy of An Attack

VulnerabilitiesPatch

95%/99%

Page 21: Gartner UK 2015 Anatomy of An Attack

> 99%

Page 22: Gartner UK 2015 Anatomy of An Attack

> 99%

Page 23: Gartner UK 2015 Anatomy of An Attack

VulnerabilitiesPatch

95%/99%Priority on Exploits

MS15-020, MS15-051

Page 24: Gartner UK 2015 Anatomy of An Attack

0-daysHardening

Page 25: Gartner UK 2015 Anatomy of An Attack
Page 26: Gartner UK 2015 Anatomy of An Attack

Then:Passwords

Page 27: Gartner UK 2015 Anatomy of An Attack

Finally:Breach Detection

Page 28: Gartner UK 2015 Anatomy of An Attack

Now: Vulnerability Assessments3 months: Passwords12 months+: Breach Detection

Page 29: Gartner UK 2015 Anatomy of An Attack

Thank youWolfgang Kandek

[email protected]@wkandek

http://www.qualys.com

Page 30: Gartner UK 2015 Anatomy of An Attack

Resources• Verizon DBIR 2015

http://www.verizonenterprise.com/DBIR/

• Chevronhttps://www.rsaconference.com/events/us15/agenda/sessions/1983/building-a-next-generation-security-architecture

• BSIhttps://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Publikationen/Lageberichte/Lagebericht2014.pdf

• Hardeninghttps://www.virusbtn.com/pdf/conference_slides/2013/Niemela-VB2013.pdf


IMA - Anatomy of an Attack - Presentation- 28Aug15

IMA - Anatomy of an Attack - Presentation- 28Aug15

Communities An Anatomy of a Mortar Attack: Sustainable ...

Communities An Anatomy of a Mortar Attack: Sustainable ...

ShadyRAT: Anatomy of targeted attack

ShadyRAT: Anatomy of targeted attack

Anatomy of a DDoS attackindex-of.es/Attacks/403 Forbidden Attack/Anatomy-of... · DDoS Attack Backfires: Targeted Site’s Performance Improves A few hours into the attack, the attacker’s

Anatomy of a DDoS attackindex-of.es/Attacks/403 Forbidden Attack/Anatomy-of... · DDoS Attack Backfires: Targeted Site’s Performance Improves A few hours into the attack, the attacker’s

Cybersecurity Incident Response: How to Survive an … Incident Response: How to Survive an Attack ... Gartner 1. Inventory of ... Source: Gartner Toolkit ...

Cybersecurity Incident Response: How to Survive an … Incident Response: How to Survive an Attack ... Gartner 1. Inventory of ... Source: Gartner Toolkit ...

Photographic Anatomy of a Black-op Psi-Attack

Photographic Anatomy of a Black-op Psi-Attack

Anatomy of a Database Attack - gavinsoorma.com€¦ · Anatomy of a Database Attack ... dbms_output.put_line(str); execute immediate str; ... + Virtual Patching & Protocol Validation

Anatomy of a Database Attack - gavinsoorma.com€¦ · Anatomy of a Database Attack ... dbms_output.put_line(str); execute immediate str; ... + Virtual Patching & Protocol Validation

HACKERS & ATTACK ANATOMY - SNIA · ISE Proprietary HACKERS & ATTACK ANATOMY Geoff Gentry, Regional Director | ggentry@securityevaluators.com

HACKERS & ATTACK ANATOMY - SNIA · ISE Proprietary HACKERS & ATTACK ANATOMY Geoff Gentry, Regional Director | [email protected]

Anatomy of An Attack August 2014

Anatomy of An Attack August 2014

Anatomy of a Terrorist Attack

Anatomy of a Terrorist Attack

anatomy of a network attack - pub - APRICOTapricot.net/.../ryan-anatomy-network-attack-tut.pdf · • The attack is sent to a destination IP and port, and comes from spoofed source

anatomy of a network attack - pub - APRICOTapricot.net/.../ryan-anatomy-network-attack-tut.pdf · • The attack is sent to a destination IP and port, and comes from spoofed source

Hackers, Attack Anatomy & Security Trends by Ted Harrington of ISE

Hackers, Attack Anatomy & Security Trends by Ted Harrington of ISE

Anatomy of an Attack: How to Defend Against a Multi-Stage Attack

Anatomy of an Attack: How to Defend Against a Multi-Stage Attack

The Anatomy of an Anonymous Attack

The Anatomy of an Anonymous Attack

E-BOOK LIST - librarydmims.comlibrarydmims.com/pdf/jnmc_e_book.pdf · 1 A Textbook of Neuroanatomy 2006 Gartner Anatomy 2 ABC ... 61 Clinical Anatomy by Regions 8 Snell Anatomy ...

E-BOOK LIST - librarydmims.comlibrarydmims.com/pdf/jnmc_e_book.pdf · 1 A Textbook of Neuroanatomy 2006 Gartner Anatomy 2 ABC ... 61 Clinical Anatomy by Regions 8 Snell Anatomy ...

Beslan - Anatomy of a Terrorist Attack - ACCUEIL

Beslan - Anatomy of a Terrorist Attack - ACCUEIL

Anatomy of a Terrorist Attack - ETH Z · This working paper is one of several outcomes of Professor William W. Keller’s “Anatomy of a Terrorist Attack” Capstone course from

Anatomy of a Terrorist Attack - ETH Z · This working paper is one of several outcomes of Professor William W. Keller’s “Anatomy of a Terrorist Attack” Capstone course from

Anatomy of a Cyber Attack - IACCE€¦ · Anatomy of a Cyber Attack A Reality Check for Business Decision Makers including Executives, Directors, and Owners. Bruce Ward, Vice President

Anatomy of a Cyber Attack - IACCE€¦ · Anatomy of a Cyber Attack A Reality Check for Business Decision Makers including Executives, Directors, and Owners. Bruce Ward, Vice President

Anatomy of a Public Cloud Attack | CSA Orlando

Anatomy of a Public Cloud Attack | CSA Orlando

The Target Breach: Anatomy of an Attack

The Target Breach: Anatomy of an Attack