Upload File

determining evil from benign in the normally abnormal ... · determining evil from benign in the...

  • Home
  • Documents
  • Determining Evil from Benign in the Normally Abnormal ... · Determining Evil from Benign in the Normally Abnormal World of InfoSec Rick McElroy, Security Strategist @infosecrick
24
Determining Evil from Benign in the Normally Abnormal World of InfoSec Rick McElroy, Security Strategist @infosecrick 09-07-18

Upload: others

Post on 16-Apr-2020

2 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: Determining Evil from Benign in the Normally Abnormal ... · Determining Evil from Benign in the Normally Abnormal World of InfoSec Rick McElroy, Security Strategist @infosecrick

Determining Evil from Benign in the Normally Abnormal World of InfoSec

Rick McElroy, Security Strategist@infosecrick

09-07-18

Page 2: Determining Evil from Benign in the Normally Abnormal ... · Determining Evil from Benign in the Normally Abnormal World of InfoSec Rick McElroy, Security Strategist @infosecrick

I © 2018 Carbon Black. All Rights Reserved. I CONFIDENTIAL2

Know normal.

Find evil.

Page 3: Determining Evil from Benign in the Normally Abnormal ... · Determining Evil from Benign in the Normally Abnormal World of InfoSec Rick McElroy, Security Strategist @infosecrick

I © 2018 Carbon Black. All Rights Reserved. I CONFIDENTIAL3

VISION

A World Safe from Cyber Attacks

Page 4: Determining Evil from Benign in the Normally Abnormal ... · Determining Evil from Benign in the Normally Abnormal World of InfoSec Rick McElroy, Security Strategist @infosecrick

I © 2018 Carbon Black. All Rights Reserved. I CONFIDENTIAL4

NORMAL ABNORMAL

MITRE

ATT&CKTM

Page 5: Determining Evil from Benign in the Normally Abnormal ... · Determining Evil from Benign in the Normally Abnormal World of InfoSec Rick McElroy, Security Strategist @infosecrick

I © 2018 Carbon Black. All Rights Reserved. I CONFIDENTIAL5

"There aren't necessarily clear points of

difference between what's normal and

abnormal. Abnormal behavior may

just be an exaggeration of normalbehavior.”

- Professor David Watson

Page 6: Determining Evil from Benign in the Normally Abnormal ... · Determining Evil from Benign in the Normally Abnormal World of InfoSec Rick McElroy, Security Strategist @infosecrick

I © 2018 Carbon Black. All Rights Reserved. I CONFIDENTIAL6

Levels of Abnormal Process

Memory

System

User

Team

Department

Company

Industry

Country

Global

Page 7: Determining Evil from Benign in the Normally Abnormal ... · Determining Evil from Benign in the Normally Abnormal World of InfoSec Rick McElroy, Security Strategist @infosecrick

I © 2018 Carbon Black. All Rights Reserved. I CONFIDENTIAL7

Evil

Current TableActual Table

Normal Benign

Abnormal Evil

Normal Evil

Abnormal Benign

Frequent GOOD!!

Infrequent BAD!!

(Lawful Good) (Chaotic Good)

(Chaotic Evil) (Lawful Evil)

Page 8: Determining Evil from Benign in the Normally Abnormal ... · Determining Evil from Benign in the Normally Abnormal World of InfoSec Rick McElroy, Security Strategist @infosecrick

I © 2018 Carbon Black. All Rights Reserved. I CONFIDENTIAL8

Page 9: Determining Evil from Benign in the Normally Abnormal ... · Determining Evil from Benign in the Normally Abnormal World of InfoSec Rick McElroy, Security Strategist @infosecrick

I © 2018 Carbon Black. All Rights Reserved. I CONFIDENTIAL9

Evil..or not Evil?

Normal Benign

Abnormal Evil

Normal Evil

Abnormal Benign

Page 10: Determining Evil from Benign in the Normally Abnormal ... · Determining Evil from Benign in the Normally Abnormal World of InfoSec Rick McElroy, Security Strategist @infosecrick

I © 2018 Carbon Black. All Rights Reserved. I CONFIDENTIAL10

Evil..or not Evil?

Normal Benign

Abnormal Evil

Normal Evil

Abnormal Benign

Page 11: Determining Evil from Benign in the Normally Abnormal ... · Determining Evil from Benign in the Normally Abnormal World of InfoSec Rick McElroy, Security Strategist @infosecrick

I © 2018 Carbon Black. All Rights Reserved. I CONFIDENTIAL11

Evil..or not Evil?

Normal Benign

Abnormal Evil

Normal Evil

Abnormal Benign

Page 12: Determining Evil from Benign in the Normally Abnormal ... · Determining Evil from Benign in the Normally Abnormal World of InfoSec Rick McElroy, Security Strategist @infosecrick

I © 2018 Carbon Black. All Rights Reserved. I CONFIDENTIAL12

Evil..or not Evil?

Normal Benign

Abnormal Evil

Normal Evil

Abnormal Benign

Page 13: Determining Evil from Benign in the Normally Abnormal ... · Determining Evil from Benign in the Normally Abnormal World of InfoSec Rick McElroy, Security Strategist @infosecrick

I © 2018 Carbon Black. All Rights Reserved. I CONFIDENTIAL13

Evil..or not Evil?

Normal Benign

Abnormal Evil

Normal Evil

Abnormal Benign

¯\_(ツ)_/¯

Page 14: Determining Evil from Benign in the Normally Abnormal ... · Determining Evil from Benign in the Normally Abnormal World of InfoSec Rick McElroy, Security Strategist @infosecrick

I © 2018 Carbon Black. All Rights Reserved. I CONFIDENTIAL14

Know normal.

Find evil.

Page 15: Determining Evil from Benign in the Normally Abnormal ... · Determining Evil from Benign in the Normally Abnormal World of InfoSec Rick McElroy, Security Strategist @infosecrick

I © 2018 Carbon Black. All Rights Reserved. I CONFIDENTIAL15

Page 16: Determining Evil from Benign in the Normally Abnormal ... · Determining Evil from Benign in the Normally Abnormal World of InfoSec Rick McElroy, Security Strategist @infosecrick

I © 2018 Carbon Black. All Rights Reserved. I CONFIDENTIAL16

Goals of Effort

We want everyone to contribute data back to MITRE

We want to help teach developers to do the right thing

We want to reduce false positives for everyone

We want to save everyone time

Page 17: Determining Evil from Benign in the Normally Abnormal ... · Determining Evil from Benign in the Normally Abnormal World of InfoSec Rick McElroy, Security Strategist @infosecrick

I © 2018 Carbon Black. All Rights Reserved. I CONFIDENTIAL17

Our Commitment Slide

Host NORMINT Slack

Provide good known binaries back to MITRE

Page 18: Determining Evil from Benign in the Normally Abnormal ... · Determining Evil from Benign in the Normally Abnormal World of InfoSec Rick McElroy, Security Strategist @infosecrick

I © 2018 Carbon Black. All Rights Reserved. I CONFIDENTIAL18

Page 19: Determining Evil from Benign in the Normally Abnormal ... · Determining Evil from Benign in the Normally Abnormal World of InfoSec Rick McElroy, Security Strategist @infosecrick

I © 2018 Carbon Black. All Rights Reserved. I CONFIDENTIAL19

Page 20: Determining Evil from Benign in the Normally Abnormal ... · Determining Evil from Benign in the Normally Abnormal World of InfoSec Rick McElroy, Security Strategist @infosecrick

I © 2018 Carbon Black. All Rights Reserved. I CONFIDENTIAL20

“We cannot change the cards

we are dealt, just how we play

the hand.”

― Randy Pausch

Page 21: Determining Evil from Benign in the Normally Abnormal ... · Determining Evil from Benign in the Normally Abnormal World of InfoSec Rick McElroy, Security Strategist @infosecrick

I © 2018 Carbon Black. All Rights Reserved. I CONFIDENTIAL21

Know normal.

Find evil.

Page 22: Determining Evil from Benign in the Normally Abnormal ... · Determining Evil from Benign in the Normally Abnormal World of InfoSec Rick McElroy, Security Strategist @infosecrick

I © 2018 Carbon Black. All Rights Reserved. I CONFIDENTIAL22

Thank [email protected]

@infosecrick

www.CarbonBlack.com

http://www.carbonblack.com/
Page 23: Determining Evil from Benign in the Normally Abnormal ... · Determining Evil from Benign in the Normally Abnormal World of InfoSec Rick McElroy, Security Strategist @infosecrick

I © 2018 Carbon Black. All Rights Reserved. I CONFIDENTIAL23

Questions?

Page 24: Determining Evil from Benign in the Normally Abnormal ... · Determining Evil from Benign in the Normally Abnormal World of InfoSec Rick McElroy, Security Strategist @infosecrick

www.CarbonBlack.com


Benign tumors

2017-2018 Bill 79 Text of Previous Version (Apr. 25, …€¦ · Web view2018/04/25  · Whereas, these benign tumors are a significant cause of pelvic pain, abnormal uterine bleeding,

Benign Paroxysmal Positional Vertigo: An Overvie · Benign Paroxysmal Positional Vertigo: An Overview ... Benign Paroxysmal Positional Vertigo International Tinnitus Journal,

Graminex G63™ Flower Pollen Extract for Benign … Paper.pdf · Graminex G63™ Flower Pollen Extract for Benign Prostatic Hyperplasia in Men Benign Prostatic Hyperplasia: Benign

EXAMINATION OF THE GI TRATCT - A Semmelweis Egyetem ... · Sclerotherapy and banding of varices Dilatation of strictures, both benign and malignant Therapeutic Abnormal results of

Evil Genius 1 Running Head: EVIL GENIUS - PScience · Evil Genius 1 Running Head: EVIL GENIUS . Evil Genius? How Dishonesty Can Lead to Greater Creativity . Francesca Gino . Harvard

Brain Tumors: an IntroductionA brain tumor is an abnormal growth of cells inside the brain or skull; some are benign, others malignant. Tumors can grow from the brain tissue itself

Benign or not benign

1 Benign Nephrosclerosis Definition: renal changes in benign hypertension It is always associated with hyaline arteriolosclerosis. mild benign nephrosclerosis

Conquer Neoplasm Coding Challenges... · 8 Types of Neoplasms (cont.) ̶Benign neoplasm is an abnormal growth but is not cancer and does not invade surrounding tissues or metastasize

Benign Mesothelioma

Benign prostate hyperplasia and bladder outflow obstruction · Benign prostate hyperplasia (BPH) histological diagnosis Benign prostate enlargement (BPE) clinical diagnosis based

Perpendicular Blood Vessel Sealing in Surgical Practice · color of different types of normal and abnormal tissue. Nearly all benign procedures during gynecologic laparoscopy require

Hear no evil, see no evil, patch no evil: Or, how to monkey-patch safely

Concepts of Neoplasia OBJECTIVES/RATIONALE A neoplasm is an abnormal growth of tissue that may be benign or malignant. The student will identify terms

I 111 IIIII IIIII IiiI~ii~iiiiiiii~ - NASA€¦ · enlargement due to abnormal but benign multiplication of the cells thereof, often leads to compression of the urethra thereby resulting

Cancer. “Abnormal, uncontrolled growth of cells, which, if left untreated, can ultimately cause death.” Benign: not cancerous Malignant: Cancerous – capable

Cancer By Dr. El Hassan Mokhamer. What is cancer? Abnormal cell growth (neoplasia) Malignant as opposed to benign – Benign:- slow growth, non-invasive,

Dizziness...Dizziness: Differential Peripheral ! !!Abnormal sensory input ! !Vasovagal! Physiologic ! ! Visual loss or distortion ! !Orthostatic hypotension ! ! Benign positional vertigo

He who has done evil, expects evil

GESTATIONAL TROPHOBLASTIC DISEASE...HYDATIDIFORM MOLE •BENIGN TROPHOBLASTIC DISEASE •LASSIFIED AS OMPLETE OR PARTIAL MOLES MOLAR PREGNANCY IS AN ABNORMAL FORM OF PREGNANCY IN WHICH

Benign Neoplasms

ALEXEI MAXIM RUSSELL - Amazon S3...The Trasgu 87 The Boggart 109 Evil Spirits 121 Benign Spirits 136 Household Deities 141 Recommended Reading 146 & Alexei Maximm Russell* 4 INTRODUCTION

Benign Meningioma.pptx

Deliver us from Evil - Anthropology of evil

Malignant of parotid Mikulicz disease (benign lymphoepithelialjcp.bmj.com/content/jclinpath/24/8/744.full.pdf · Mikulicz disease (benign lymphoepithelial lesion) ... SYNOPSIS Benign

Benign chondroblastoma with secondary aneurysmal bone cyst ... · Benign chondroblastoma with secondary aneurysmal bone cyst in scapula. ... Puttaswamy P. Benign chondroblastoma with

Evil and Suffering. Evil Evil: “physical pain, mental suffering and moral wickedness”(John Hick, Philosophy and Religion) Four types of evil : Natural

Hear No Evil, See No Evil, Speak No Evil

Original Article Orbital Lymphangioma: Characteristics and ... · Lymphangioma is a benign tumor of the lymphatic sys- tem that is characterized by abnormal endothelial-lined channels

ABNORMAL ABNORMAL NORMAL NORMAL 10 6 10 6 ABNORMAL ABNORMAL NORMAL NORMAL 10 6 10 6

Benign Lord

€¦ · skin, fine wrinkles, abnormal blood vessels, age spots, benign and malignant skin tumors due to the deterioration of the skins immune system. Skin ageing is determined primarily

Jekyll on iOS: When Benign Apps Become Evilklu38/publications/jekyll-security13.pdfJekyll on iOS: When Benign Apps Become Evil ... School of Computer Science, College of Computing,

Abnormal Ventilation, Abnormal Gas Exchange