Rock Drops and Dragons Teeth

Transcription

1 Rock Drops and Dragons Teeth A case study of Paju, South Korea Justin Edgar Solutions Architect, FireEye

2 Agenda Introduction Background A Look at Paju Information Security Application Questions

3 Introduction Justin Edgar Solutions Architect California Native Husband, Father, Veteran

4 Background WWII Country divided along the 38 th parallel Was *supposed* to be temporary Korean War Power struggle between North and South Status quo maintained Juche Self-reliance Kim family rule Il-sung, Jong-Il, Jong-Un Cult of personality (60s/70s) Image:

5 Image:

6 Background (Contd.,) Nationalism Xenophobic Industry Consumer goods neglected over military and industrial development Military First Grandiose expenditures Pyongyang Standard Time (GMT +8.5) 170m Tall Juche Tower Image:

7 Image:

8 Background (Contd.,) The DMZ Mined like hell UM Professor Limited points of crossing Kaesong Industrial Region Joint Security Area Panmunjom 4 Known Invasion Tunnels (oops) Propaganda Village (Kijongdong) Image:

9 Image:

10 A Look at Paju X First stop South to Seoul Delaying action for Southbound troops Well within shelling distance

11 Image: A Look at Paju How do you defend a city that is within range of up to 21,000 artillery pieces? You don t. Image: Image: Image:

12 Information Security Application

13 Information Security Application

14 Information Security Application

15 Information Security Application BAD GOOD

16 Information Security Application

17 Information Security Application Perimeter defenses will fail 10 foot wall, 11 foot ladder Ben Franklin or my manager Defense in depth is good But prevention in depth will also fail How you prepare for catastrophic failure of preventative measures?

18 Information Security Application Instrument for failure Rolling barrages of artillery fire inhibit direct action response Ongoing attacks are inhibiting standard response communications The perimeter is breached User machines are compromised and are connecting to C2 Charlie is in the wire Successful credential theft has occurred Rear echelon troops are in contact with the enemy The soft underbelly of the network is exposed and data exfiltration is in-progress

19 Information Security Application What is your comms plan? Internal / external HR / Legal / Media Rehearse, rehearse, rehearse Perform a risk analysis Likely threats encountered Data types hosted IP/PHI/PII/PCI-DSS Media presence #OPYou Partner relationships Image:

20 Information Security Application Early detection of compromise Client => Client connections New client connections to server resources SMB traffic / share mounting Image:

21 Information Security Application Close examination of privileged accounts Honey accounts Change password Alert when log-in s fail Reduce service accounts Test user machines Mimikatz is an easy one! Image

22 Information Security Application Exfiltration of critical data Client connections to server resources Alert on privileged access to servers Connection analysis for anomalous internal data transfers Image

23 Summary Korea is unique There s a reason we call our externalfacing segments the DMZ Assume your prevention will fail Rehearse, rehearse, rehearse

24 QUESTIONS