Predicting and Preventing Cyber Threats. Paolo Passeri, Consulting Systems Engineer

Transcription

1 Predicting and Preventing Cyber Threats Paolo Passeri, Consulting Systems Engineer

2 The way we work has changed Internet Critical infrastructure Amazon, Rackspace, Windows Azure, etc. Business apps Salesforce, Office 365, G Suite, etc. Critical infrastructure Business apps Workplace desktops Roaming laptops Branch office

3 Users and apps have adopted the cloud, security must too 49% of the workforce is mobile 70% increase in SaaS usage 82% admit to not using the VPN 70% of branch offices have DIA Security controls must shift to the cloud

4 Somewhere on the Internet rev

5 Anatomy of a cyber attack Reconnaissance and infrastructure setup Domain registration, IP, ASN Intel Monitor adaption based on results Patient zero hit Target expansion Wide-scale expansion Defense signatures built

6 rev Who Says That a Crystal Ball Is the Only Way to Predict Cyber Attacks? 6

7 rev A Diamond (And a Bunch of Math) Can Help! 7

8 The Diamond Model of Intrusion Analysis Adversary Persona: addresses, handles, phone # s Network Assets Infrastructure Internet Addresses Domain Names Addresses Capability Malware Exploits Hacker Tools Victim Personas Network Assets Addresses

9 The Diamond Model of Intrusion Analysis Adversary Infrastructure Capability Victim

10 The Diamond Model of Intrusion Analysis Adversary Infrastructure Capability Event Victim

11 The Diamond Model of Intrusion Analysis 3 Infrastructure Name (domain) resolves to Internet Address 4 Logs reveal further Victims contacting C2 IP 5 IP Address ownership reveals adversary Adversary Victim 2 Threat contains a name (domain) Capability 1 The victim (organization) discovers a threat Model Meta Features Timestamp Phase Result Direction Methodology Resources

12 This Means That Diamonds are a girl's best friend Diamonds are an attacker s best enemies Since starting from the detection of a single event, it is possible to pivot through the attacker s infrastructure and reveal how its elements are used to carry on malicious campaign. This information can be used to expose attackers and predict future threats before they happen.

13 Using the DNS to Shift Security to the Cloud Visibility and protection for all activity, anywhere HQ IoT Mobile Branch Roaming ON-NETWORK OFF-NETWORK All office locations Any device on your network Roaming laptops Every port and protocol ALL PORTS AND PROTOCOLS

14 Statistical models 2M+ live events per second 11B+ historical events Guilt by inference Co-occurrence model Sender rank model Secure rank model Guilt by association Predictive IP Space Modeling Passive DNS and WHOIS Correlation Patterns of guilt Spike rank model Natural Language Processing rank model Live DGA prediction

15 Our view of the internet 100B requests per day 85M daily active users 12K enterprise customers 160+ countries worldwide Our efficacy Discover 3M+ daily new domain names Identify 60K+ daily malicious destinations Enforce 7M+ malicious destinations while resolving DNS

16 3D Visualization of a bad neighborhood rev

17 rev Domains in Red are malicious 17

18 rev Domains in Red are malicious These domains are visited by the same users 18

19 rev Domains in Red are malicious These domains are visited by the same users Same Internet Addresses These domains share the same infrastructure Same Nameservers 19

20 rev Current Malware Distribution Point 20

21 rev Current Malware Distribution Point Next Malware Distribution Points 21

22 rev Current Malware Distribution Point Next Malware Distribution Points Expose the attacker s infrastructure (Nameservers and Internet Addresses) to predict the next moves 22

23 rev Learn Intelligence to see attacks before they launch See Visibility to protect access everywhere Block Stop threats before connections are made 23