Real world Zero day Threat Detection and Response

Transcription

1 Real world Zero day Threat Detection and Response ILTA Webinar MAY MARK SANGSTER esentire VP Industry Security Strategies ILTA LegalSEC Council Member NLJ 2016 Legal Cybersecurity Trailblazer mobile: The Leader in Pure play Managed Detection and Response Copyright 2017 esentire, Inc. All rights reserved. Do not distribute without prior written permission.

2 MANAGED DETECTION AND RESPONSE customers $ % customer retention T assets protected employees 60 % growth We hunt down and stop dangerous new threats before they become business disrupting.

3 We Advise and Collaborate with Law Enforcement, Regulatory Agencies, Governing Bodies and Standards Orgs

4 of the 5 mostcyber attacked industries/# e LAW FIRMS ARE A TOP CYBER TARGET

5 THE COST OF CYBERCRIME REPUTATIONAL DAMAGE FINANCIAL LOSSES REGULATORY OBLIGATIONS

6 NO PRACTICE IS INOCUOS PANAMA 11.5M DOCUMENTS WikiLeaks (2010) 1.7GB 2.6 TERABYTES PAPERS

7 ASSETS HAVE ECONOMIC VALUE

8 ALL ROADS LEAD TO ROME: LAW FIRMS POLICY ISSUERS REGULATORS CYBERSECURITY VENDORS INVESTORS INVESTMENTS/CLIENTS

9 MEANS MOTIVE OPPORTUNITY ACCESS EASY LUCRATIVE IMPUNITY EASY ACCESS TO CYBER WEAPONRY MINIMAL CYBER SKILLS REQUIRED MOTIVATION IS HIGH NO NEGATIVE REPERCUSSIONS

10 THREAT TRENDS IN LAW FIRMS 80K FINANCE LAW FIRMS TECHNOLOGY 70K 60K 50K 40K 30K 20K 10K JAN FEB MAR APR MAY JUN JUL AUG SEP OCT NOV DEC

11 LAW FIRMS ARE CONFRONTED BY THE FASTEST THREAT GROWTH 380 % ATTACK INCREASE 100 % MALWARE INCREASE $ 4.0 % AVG BREACH COST

12 RANSOMWARE IS A BILLION DOLLAR INDUSTRY 40 seconds a company falls victim 70 % of companies pay the ransom 40 % spam contains ransomware 60 % infections stem from spam s $ 150 K in ransom payments $ 10 K lost billable hours per attorney

13 INDUSTRY RANSOMWARE CAMPAIGN DECEMBER subject line: The Office of The State Attorney Complaint which alluded to vague legal action against the firm PDF ATTACHMENT Claimed to contain details of the legal action Actually contained Ransomware THIS WAS EASILY DETECTABLE Legal action cannot be served by ! Sent from Outlook.com domain not GOV EASILY PREVENTABLE Security Awareness Training filtering Attachment blocking esentire MDR

14 TARGETED RANSOMWARE ATTACK 7:43AM 7:44AM 7:54AM 8:30AM AMP BLOCKS 1 st 87.exe DOWNLOADED FROM NEW IP TESLACRYPT BEACONS TO CNC SERVER SOC ALERTS ON INFECTION AND BLOCKS TRAFFIC INFECTED HOST ISOLATED/MITIGATED

15 TARGETED RANSOMWARE ATTACK DAY 01 DAY 08 DAY 12 $500K SITE 01 TESLACRYPT SITE 02 TESLACRYPT SITE 03 TESLACRYPT TOTAL BILLING LOSSES 15 Attorneys / Assistants 25 Attorneys / Assistants 20 Attorneys / Assistants 5.5 Hours to Detect 2.0 Days to Recover 4.0 Days to Recover 700GB Encrypted 1.5 Days to Recover

16 RANSOMWARE: WHY YOU SHOULD BACK UP FILES ENCRYPTED SCREENCAP Bitcoin Account 0.25 Bitcoin 20 YEARS 0.50 Bitcoin OF LITIGATION RECORDS IT FIRM WIPES SYSTEM INCLUDNG SCREEN CAP DELETE ALL FILES HOURS HOURS HOURS HOURS HOURS

17 TARGETED RANSOMWARE ATTACK $25,000 $700,000 LAW SUIT RANSOMWARE Negotiated to release files but not all keys worked Paid more bitcoins for additional tools LOST BILLABLE HOURS Recovery lasted months the firm s 10 lawyers were left unproductive and inefficient Based on year year billing comparisons SENTINEL INSURANCE CO. Breach of contract and bad faith After denying claim lost income Coverage included business income (limited to 12 months of losses) Claim limited to $20K for computer fraud

18 COMBATING RANSOMWARE DIRECTORS Payment Policy INFO SEC Backups & Testing INFO SEC Application Controls EMPLOYEES Training & Alerting EXECUTIVE Client Notification Disruption Plan INFO SEC Application Whitelisting INFO SEC Ad Blocking

19 BUSINESS DISRPUPTION TARGETED ATTACKS $400,000 FAKE INVOICES COMPROMISE $3.1 BILLION LOST RANSOMWARE $500,000 LOSSES RANSOMWARE $5.5 LARGEST HIPAA FINE $ TARGETED ATTACKS $10M PII FINE TRILLION MERCENARY HACKERS $30 MILLION IN SEC FINES PHISHING CAMPAIGN $1.9 MILLION STOLEN IN 24 HOURS NATION STATE/HACTIVISM GEODATA THEFT/SCADA DISRUPTION

20 PEN TESTING CLOUD ACCESS USER ANALYTICS SIEM BIOMETRICS NGFW SPAM FILTERS VPN UTM IDS FIREWALL THREAT ANALYTICS MACHINE LEARNING SPEND $1 TRILLION ACCESS CONTROL ADAPTIVE USER BEHAVIOR APPLICATION TESTING VIRTUALIZATION SOFTWARE DEFINED SECURITY ACCESS MANAGEMENT MDM ENDPOINT WEB APPLICATION BIG DATA SANDBOX IPS MULTIFACTOR AUTHENTICATION DLP TAR PITS ENCRYPTION HONEYPOTS INCIDENT RESPONSE

21 ALONE CANNOT PREVENT CYBER ATTACKS

22 MOVE QUICKER THAN SIGNATURES AND THREAT INTELLIGENCE CAN RESPOND

23 SENSITIVITY COST LIKELIHOOD DIFFICULTY

24 CRIMINALS DON T FOLLOW RULES

25 YOU CAN T SIMPLY CHECK A BOX

26 Cybersecurity Legal Task Force THE ABA CYBERSECURITY HANDBOOK A R E S O U R C E F O R A T T O R N E Y S, L A W F I R M S, A N D B U S I N E S S P R O F E S S I O N A L S JILL D. RHODES AND VINCENT I. POLLEY 1 CYBERSECURITY 2 RISK 3 PROTECTION 4 DETECTION 5 USER 6 RISKS GOVERNANCE Governance Asset Inventory Regulatory Requirements Insurance ASSESSMENT Risk Profile Vulnerability Assessments SW/App Assessments OF NETWORK AND DATA Security Assets Policies & Procedures Encryption Mobile OF UNAUTHORIZED ACTIVITY &RESPONSE Unauthorized Activity Incident Response Threat Intelligence TRAINING Documented Training Testing Friendly Attacks ASSOCIATED WITH VENDORS AND THIRD PARTIES Risk Assessment Contracts Access Controls Incident Response SOC II

27 The CISO is the LEAST important person to the board, until they are the MOST important person to the BOARD.

28 CYBERSECURITY GOVERANCE ABA CYBERSECURITY HANDBOOK 01 GOVERANCE POLICY 04 CYBER INSURANCE ASSET INVENTORY CISO/CSO/CPO REGULATORY REQUIREMENTS REPORTING

29 CYBERSECURITY RISK ABA CYBERSECURITY HANDBOOK 01 RISK PROFILE 04 VULNERABILITY ASSESSMENT APPLICATION ASSESSMENT 03 06

30 PROTECTION OF NETWORK & DATA ABA CYBERSECURITY HANDBOOK 01 SECURITY FRAMEWORK 04 ENCRYPTION NETWORK ASSETS REMOTE BANKING POLICIES & PROCEDURES MOBILE DEVICES

31 DETECTION OF UNAUTHORIZED ACTIVITY ABA CYBERSECURITY HANDBOOK 01 DETETCTION 04 EVENT RESPONSE INCIDENT RESPONSE REMEDIATION THREAT INTELLIGENCE LEARN & ADAPT

32 KNOWN ATTACKS KNOWN THREATS KNOWN SIGNATURES THREAT INTELLIGENCE SYSTEMIC VULNERABILITYES

33 KNOWN ATTACKS KNOWN THREATS KNOWN SIGNATURES THREAT INTELLIGENCE SYSTEMIC VULNERABILITYES TARGETED ATTACKS ANOMALOUS SIGNAL DETECTION BEHAVIOURAL ANALYTICS EXPLOITS ZERO DAY ATTACKS UNKNOWN ATTACKS

34 DETECTING UNKNOWN THREATS SIGNAL INGESTION SIGNAL ENRICHMENT CORRELATE & INVESTIGATION SOC RESPONSE

35 LOGGING IS NOT DETECTION NOR CONTAINMENT INTERNET DETECTION INVESTIGATION RESPONSE NETWOR K KNOWN MALWARE NGFW!! SECURITY EVENT GENERATED BLOCKED SERVERS WORKSTATIONS PROXY SIEM SECURITY OPERATIONS ENDPOINTS DOMAIN CONTROLLER SECURITY EVENT LOGGED CLOUD SERVICES

36 LOGGING IS NOT DETECTION NOR CONTAINMENT INTERNET DETECTION INVESTIGATION RESPONSE NETWOR K POSSIBLE ATTACK NGFW? SECURITY EVENT GENERATED SERVERS WORKSTATIONS PROXY SIEM SECURITY OPERATIONS ENDPOINTS DOMAIN CONTROLLER CLOUD SERVICES

37 LOGGING IS NOT DETECTION NOR CONTAINMENT INTERNET DETECTION INVESTIGATION RESPONSE NETWOR K NGFW UNKNOWN THREAT NO SECURITY EVENT DETECTED SERVERS WORKSTATIONS PROXY SIEM ENDPOINTS SECURITY OPERATIONS DOMAIN CONTROLLER NO SECURITY EVENT LOGGED CLOUD SERVICES

38 DETECTING & CONTAINING UNKNOWN THREATS INTERNET UNKNOWN THREAT DETECTION NGFW BEHAVIORAL ANALYTICS ANOMALY ANALYTICS INVESTIGATION ENHANCED DETECTION RESPONSE BLOCKED NETWOR K SERVERS WORKSTATIONS PROXY SIEM DOMAIN CONTROLLER THREAT INTELLIGENCE SIGNAL ENRICHMENT LOCAL CONTEXT LEARN EAST/WEST TRAFFIC SECURITY OPERATIONS ENDPOINTS CLOUD SERVICES

39 RAW EVENTS 750,000,000 ALERTS 200,000 INVESTIGATED 14,000,000 MALWARE 40% ESCALATION 5, SOC DATA

40 USER TRAINING ABA CYBERSECURITY HANDBOOK 01 AWARENESS TRAINING 04 BOARD TRAINING TESTING ATTACK CAMPAIGNS FRIENDLY ATTACKS ALERTING/REPORTING

41 RISKS ASSOCIATED WITH VENDORS & 3PS ABA CYBERSECURITY HANDBOOK 01 RISK ASSESSMENTS 04 REMOTE ACCESS CONTRACTUAL ELEMENTS INCIDENT RESPONSE ACCESS CONTROLS SOC II CERTIFICATION

42 CYBERSECURITY WORKBOOKS (based on ABA Cybersecurity Handbook) Cybersecurity Legal Task Force THE ABA CYBERSECURIT Y HANDBOOK A R E S O U R C E F O R A T T O R N E Y S, L A W F I R M S, A N D B U S I N E S S P R O F E S S I O N A L S

43 RANSOMWARE DEFENSE MATRIX CYBERSECURITY RESPONSE RECOMMENDATIONS ebook to pay or not to pay/ HUMAN RISK MITIGATION GENERAL SECURITY SERVICE PROVIDERS NETWORK SECURITY LOCAL SERVERS ENDPOINT PROTECTION

44 2017 ILTA ROADSHOW Book a meeting: lindsay.snider@esentire.com Phoenix (AZ) APR 25 Denver (CO) APR 26 Cincinnati (OH) MAY 09 St. Louis (MI) MAY 11 Miami (FL) JUL 12 Orlando (FL) JUL 13 Toronto (CAN) SEP 07 Los Angeles (CA) SEP 12 Las Vegas (NV) SEP 13 San Francisco (CA) SEP 19 Seattle (WA) SEP 20 Vancouver (CAN) SEP 21 Charlotte (NC) OCT 10 Atlanta (GA) OCT 11 Nashville (TN) OCT 12 Houston (TX) OCT 17 Dallas (TX) OCT 18 New Orleans (LA] OCT 19 Chicago [IL] OCT 24 Boston (MA) NOV 14 New York (NY) NOV 15 Philadelphia (PA) NOV 16 Washington (DC) NOV 17

45