Upload File

and what we learned from them - riskiq€¦ · let’s talk initial attack vectors 5. 13/06/2019...

  • Home
  • Documents
  • and what we learned from them - RiskIQ€¦ · LET’S TALK INITIAL ATTACK VECTORS 5. 13/06/2019 Safely Enabling Business BIGGER IS MORE SECURE 6 ATTACK FACTOR per 100/employees 9.1
17
SAFELY ENABLING BUSINESS www.securelink.net 20.000 attacks bypassing our defenses and what we learned from them Eward Driehuis • @e3huis • www.securelink.net

Upload: others

Post on 05-Aug-2020

0 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: and what we learned from them - RiskIQ€¦ · LET’S TALK INITIAL ATTACK VECTORS 5. 13/06/2019 Safely Enabling Business BIGGER IS MORE SECURE 6 ATTACK FACTOR per 100/employees 9.1

SAFELY ENABLING BUSINESS www.securelink.net

2 0 . 0 0 0 a t t a c k s b y p a s s i n g o u r d e f e n s e sa n d w h a t w e l e a r n e d f r o m t h e m

E w a r d D r i e h u i s • @ e 3 h u i s • w w w . s e c u r e l i n k . n e t

Page 2: and what we learned from them - RiskIQ€¦ · LET’S TALK INITIAL ATTACK VECTORS 5. 13/06/2019 Safely Enabling Business BIGGER IS MORE SECURE 6 ATTACK FACTOR per 100/employees 9.1

SAFELY ENABLING BUSINESS www.securelink.net

THIS STORY IS BASED ON TRUE DATA

• 700+ SecureLink’ers

• 2100 customers in 2018

• 5 Cyber Defense Centers

• Over 10 trillion signals

2019-06-132

RESEARCH

Page 3: and what we learned from them - RiskIQ€¦ · LET’S TALK INITIAL ATTACK VECTORS 5. 13/06/2019 Safely Enabling Business BIGGER IS MORE SECURE 6 ATTACK FACTOR per 100/employees 9.1

SAFELY ENABLING BUSINESS www.securelink.net32019-06-13

2006 - 2010

2013

2017

2019

Page 4: and what we learned from them - RiskIQ€¦ · LET’S TALK INITIAL ATTACK VECTORS 5. 13/06/2019 Safely Enabling Business BIGGER IS MORE SECURE 6 ATTACK FACTOR per 100/employees 9.1

SAFELY ENABLING BUSINESS www.securelink.net13/06/2019

A LOOK AT OUR NUMBERS

4

• Signal to incident process

• Layered detection: malware wins

• Many “strange events”

Page 5: and what we learned from them - RiskIQ€¦ · LET’S TALK INITIAL ATTACK VECTORS 5. 13/06/2019 Safely Enabling Business BIGGER IS MORE SECURE 6 ATTACK FACTOR per 100/employees 9.1

SAFELY ENABLING BUSINESS www.securelink.net13/06/2019

• Cybercriminals & spies using same methods: social engineering

• Automated scanning: software & versions, password stuffing

LET’S TALK INITIAL ATTACK VECTORS

5

Page 6: and what we learned from them - RiskIQ€¦ · LET’S TALK INITIAL ATTACK VECTORS 5. 13/06/2019 Safely Enabling Business BIGGER IS MORE SECURE 6 ATTACK FACTOR per 100/employees 9.1

Safely Enabling Business www.securelink.de13/06/2019

BIGGER IS MORE SECURE

6

ATTACK FACTORper 100/employees

9.1 1.5 1.3

Page 7: and what we learned from them - RiskIQ€¦ · LET’S TALK INITIAL ATTACK VECTORS 5. 13/06/2019 Safely Enabling Business BIGGER IS MORE SECURE 6 ATTACK FACTOR per 100/employees 9.1

SAFELY ENABLING BUSINESS www.securelink.net13/06/2019

• Ransomware is hard work• Cryptojacking super easy• Inverse correlation

HIGH BITCOIN PRICE, HIGH SECURITY?

7

0

5

10

15

20

25

jan feb mrt apr mei jun jul aug sep okt nov dec jan feb mrt apr

Qtr1 Qtr2 Qtr3 Qtr4 Qtr1 Qtr2

2018 2019

CryptocurrencyMinerRansomware

Page 8: and what we learned from them - RiskIQ€¦ · LET’S TALK INITIAL ATTACK VECTORS 5. 13/06/2019 Safely Enabling Business BIGGER IS MORE SECURE 6 ATTACK FACTOR per 100/employees 9.1

SAFELY ENABLING BUSINESS www.securelink.net8

Page 9: and what we learned from them - RiskIQ€¦ · LET’S TALK INITIAL ATTACK VECTORS 5. 13/06/2019 Safely Enabling Business BIGGER IS MORE SECURE 6 ATTACK FACTOR per 100/employees 9.1

SAFELY ENABLING BUSINESS www.securelink.net

OPPORTUNITY FOR

VETERANCRIMINALS

2019-06-139

Quietly enter network• Look for value• Steal or extort value

Plan B• Destroy online back-ups• Ransom network• Extort enterprise ransom

Page 10: and what we learned from them - RiskIQ€¦ · LET’S TALK INITIAL ATTACK VECTORS 5. 13/06/2019 Safely Enabling Business BIGGER IS MORE SECURE 6 ATTACK FACTOR per 100/employees 9.1

SAFELY ENABLING BUSINESS www.securelink.net

THE POWEROF BIG NUMBERS

10

BIG DATA

RETAIL FRAUD

CREDIT CARD THEFT

RANSOMWARE &

MINING

BESPOKE ATTACKS

RANSOM / EXTORTION

ESPIONAGE

Page 11: and what we learned from them - RiskIQ€¦ · LET’S TALK INITIAL ATTACK VECTORS 5. 13/06/2019 Safely Enabling Business BIGGER IS MORE SECURE 6 ATTACK FACTOR per 100/employees 9.1

SAFELY ENABLING BUSINESS www.securelink.net13/06/2019

GEOPOLITICSTHE AGE OF CYBER WARFARE

11

Showing destruction

Filling budget gaps

Gentlemanspies

Page 12: and what we learned from them - RiskIQ€¦ · LET’S TALK INITIAL ATTACK VECTORS 5. 13/06/2019 Safely Enabling Business BIGGER IS MORE SECURE 6 ATTACK FACTOR per 100/employees 9.1

SAFELY ENABLING BUSINESS www.securelink.net

ARE YOU INTERESTING?

OR ARE YOU LUCKY?

TARGET

VICTIM

COLLATERAL

LUCKY122019-06-13

Page 13: and what we learned from them - RiskIQ€¦ · LET’S TALK INITIAL ATTACK VECTORS 5. 13/06/2019 Safely Enabling Business BIGGER IS MORE SECURE 6 ATTACK FACTOR per 100/employees 9.1

SAFELY ENABLING BUSINESS www.securelink.net13/06/2019

We stillencounter

“Wannacry”Sometimes for

understandablereasons

WE NEED TO EVOLVE, BUT… WE DON’T.

DepressingCSIRT tales

Single factor + cloud

= guaranteed

pwnage

13

Page 14: and what we learned from them - RiskIQ€¦ · LET’S TALK INITIAL ATTACK VECTORS 5. 13/06/2019 Safely Enabling Business BIGGER IS MORE SECURE 6 ATTACK FACTOR per 100/employees 9.1

SAFELY ENABLING BUSINESS www.securelink.net

RISK IS NOT WHAT IS

USED TO BE

• CxOs manage more risks than cyber• Talk about likeliness & impact, be “realistic”• Draw two lines in the sand

prevent

detect & respond

accept / insure

Page 15: and what we learned from them - RiskIQ€¦ · LET’S TALK INITIAL ATTACK VECTORS 5. 13/06/2019 Safely Enabling Business BIGGER IS MORE SECURE 6 ATTACK FACTOR per 100/employees 9.1

SAFELY ENABLING BUSINESS www.securelink.net2019-06-1315

Page 16: and what we learned from them - RiskIQ€¦ · LET’S TALK INITIAL ATTACK VECTORS 5. 13/06/2019 Safely Enabling Business BIGGER IS MORE SECURE 6 ATTACK FACTOR per 100/employees 9.1

SAFELY ENABLING BUSINESS www.securelink.net2019-06-13

• We need toevolve as peopleto keep in pace with tech

WE TALK THE TALK…

• We lackfoundation

• We lack visibility• Specifically on

the 1%

16

Page 17: and what we learned from them - RiskIQ€¦ · LET’S TALK INITIAL ATTACK VECTORS 5. 13/06/2019 Safely Enabling Business BIGGER IS MORE SECURE 6 ATTACK FACTOR per 100/employees 9.1

SAFELY ENABLING BUSINESS www.securelink.net2019-06-1317

SAFELY ENABLING BUSINESS

HTTPS://SECURELINK.NET/SMA

Download our 2019 SMA at:


Bigger Shoes

SUSANNA BIGGER

Will Bigger Data Mean Bigger Problems or Opportunities?

Dream Bigger

Popular Protocol attack Smurf Attack Introduction: … Protocol attack!Smurf Attack!SYN attack!UDP Attack, ICMP Attack!CGI request attack!Authentication server attack!Attack using

Effective Governance, Risk & Compliance · 1 © RiskIQ Limited Effective Governance, Risk & Compliance Reflections on Enabling Infrastructure June 2016

Forbes billionaire lists gets bigger and bigger!

smarter telescopes Topic 4: Bigger andthemrriddle.weebly.com/uploads/5/9/3/2/59324797/topic_4...build bigger and bigger telescopes. Bigger telescopes can help us to find new objects

BIGGER& BETTER

Kindergarten Unit 4 Bigger Books Bigger Reading Muscles

Popular Protocol attack Smurf Attack Introduction: …jeffay/courses/nidsS05/slides/5-Protocol-Attacks.pdf · Popular Protocol attack!Smurf Attack!SYN attack!UDP Attack, ... Features

Advanced Use Case - RiskIQ · The tracker information is very unusual. RiskIQ crawls the entire open web’s IPV4 space. When we get the DOM and responses, we are able to understand

SpanSet Xtirpa XLT. Bigger, BIGGER, BIGGEST!

Thinking Bigger

Susanna Bigger

Group protrust thinking ahead building ahead bigger than bigger

ThreatSTOP Operationalizes RiskIQ Threat Intelligence · 2020-01-24 · The Challenge Organizations leverage high quality, relevant threat intelligence to investigate threats, monitor

Apple iphone 6 bigger than bigger digital launch – content analyses

Leo Bigger

STRATEGIC PARTNERS - Kudelski Security · Payoda (AppViewX) Proofpoint ProtectWise Qualys QRadar Radware Rapid7 RiskIQ SecureAuth SlashNext Tenable Thycotic TrapX Trend Micro Tripwire

RiskIQ Across the Globe June 2019 · RiskIQ Across the Globe Customer Stories and Partner Integrations Benjamin Powell Technical Marketing Manager

Turla Waterhole Attack Investigation - RiskIQ · The Turla Waterhole attack was a malicious reconnaissance campaign that targeted ministry and embassy websites. All of the targeted

SUSANNA BIGGER LEO BIGGER WHEN AM I EASILY HURT?

A bigger view of UX doesn't need a bigger screen

MEWKit: Cryptotheft’s Newest Weapon - RiskIQ...Introduction When you think cryptocurrency, you think of massive price fluctuations1, exchange breaches2, ransom extortion3 and many,

ATTACK, ATTACK, ATTACK

LEO BIGGER

Bigger and bigger wind turbine installation cranes: what next?

hidecorg.files.wordpress.com...They grow bigger. And bigger And bigger. And bigger And bigger. Until that baby becomes an adult.

Infoblox Solutions for Service Providers€¦ · now. Appears to be bigger than the #Spamhaus attack from last year. Mitigating. Someone’s got a big, new cannon. Start of ... DNS

Securing the Supply Chain - Accenture...and cyber supply chain security. Larger, more flexible supply chain networks provide malicious and criminal actors with a bigger cyber-attack

Bigger salary

Security in a Borderless World Finding Unknown Risks, 0-day Threats and Measurable Enforcement Gerry Dagostino Director RiskIQ

Bigger and Bigger - Community Catalyst

ThreatSTOP Operationalizes RiskIQ Threat Intelligence€¦ · brand abuse. Security and network operations teams can recognize greater value from that threat intelligence by operationalizing