Targeted attacks

Targeted Attacks

Barry Shteiman
Director of Security Strategy

1

© 2013 Imperva, Inc. All rights reserved.

Confidential

Agenda

 Compromised Insider
 Incident Analysis

 Anatomy of an Attack
 Current Controls
 Reclaiming Security

2


Confidential

Today’s Speaker - Barry Shteiman

 Director of Security Strategy

 Security Researcher working
with the CTO office
 Author of several application
security tools, including HULK

 Open source security projects
code contributor
 CISSP

 Twitter @bshteiman

3


Confidential

Compromised Insider
Defining the Threat Landscape

4


Confidential

―There are two types of companies: companies
that have been breached and companies that
don’t know they’ve been breached.‖
Shawn Henry, Former FBI Executive Assistant Director
NY Times, April 2012

5


Confidential

Insider Threat Defined

Risk that the access rights of a
trusted person will be used to view,
take or modify data or intellectual
property.
Possible causes:
 Accident
 Malicious intent
 Compromised device

6


Confidential

Compromised Insider Defined

A person with no malicious
motivation who becomes an
unknowing accomplice of third
parties who gain access to their
device and/or user credentials.

7


Confidential

Malicious vs Compromised Potential

1% < 100%

Source: http://edocumentsciences.com/defend-against-compromised-insiders
8


Confidential

Look who made the headlines

Hackers steal sensitive data related to a
planned 2.4B acquisition.

Hacker stole 4-million Social Security
numbers and bank account information from
state tax payers and businesses

9


Confidential

Evaluating Magnitude

California 2012 Data Breach Report:
• More than half of the breaches were the result of intentional
intrusions by outsiders or by unauthorized insiders.
Source: State of California Department of Justice, July 2013

Source: Verizon Data Breach Report, 2013
10


Confidential

Know your Attacker
Governments
•
•

Stealing Intellectual Property (IP) and raw data, Espionage
Motivated by: Policy, Politics and Nationalism

Industrialized hackers
•
•

Stealing IP and data
Motivated by: Profit

Hacktivists
•
•

11


Exposing IP and data, and compromising the infrastructure
Motivated by: Political causes, ideology, personal agendas

Confidential

What Attackers Are After


12


Confidential

Two Paths, One Goal
Online
Application

User with access
rights (or his/her
device)

Malware (40%)
Social Engineering (29%)

Users (devices) 71%
People 29%

Hacking (various) used
in 52% of breaches

Servers 54%

Data & IP


13


Confidential

Incident Analysis
The South Carolina Data Breach

14


Confidential

What Happened?

4M Individual Records Stolen in a Population of 5M

80%.
15


Confidential

A Targeted Database Attack

Attacker steals
login credentials
via phishing email
& malware
13-Aug-12

16

Attacker logs in
remotely and
accesses the
database
27-Aug-12


Additional
reconnaissance,
more credentials
stolen
29-Aug-12 11-Sept-12

Confidential

Attacker steals the
entire database

12-Sept-12 14-Sept-12

The Anatomy of an Attack
How does it work

17


Confidential

Anatomy of an Attack

Spear
Phishing

18


Confidential


Spear
Phishing

19

C&C
Comm


Confidential


Spear
Phishing

20

C&C
Comm


Data Dump
& Analysis

Confidential


Spear
Phishing

21

C&C
Comm


Data Dump
& Analysis

Broaden
Infection

Confidential


Spear
Phishing

22

C&C
Comm


Data Dump
& Analysis

Broaden
Infection

Confidential

Main Data
Dump


Spear
Phishing

23

C&C
Comm


Data Dump
& Analysis

Broaden
Infection

Confidential

Main Data
Dump

Wipe
Evidence

Searching on Social Networks…

24


Confidential

…The Results

25


Confidential

Next: Phishing and Malware
Specialized Frameworks and Hacking tools, such as BlackHole
2.0, allow easy setup for Host Hijacking and Phishing.

How easy is it?

 A three-month BlackHole license,
with Support included, is US$700

26


Confidential

Drive-by Downloads Are Another Route
September 2012 ―iPhone 5 Images Leak‖ was caused by a
Trojan Download Drive-By

27


Confidential

Cross Site Scripting Is Yet Another Path
Persistent XSS Vulnerable Sites provide the Infection Platform
GMAIL, June 2012

TUMBLR, July 2012

28


Confidential

The Human Behavior Factor

Source: Google Research Paper ―Alice in Warningland‖, July 2013
29


Confidential

Current Controls
Wont the NGFW/IPS/AV Stop It?

30


Confidential

What Are the Experts Saying?

―Flame was a failure for the antivirus industry. We really should have been able
to do better. But we didn’t. We were out of our league, in our own game.‖
Mikko Hypponen, F-Secure, Chief Research Officer
Source: http://www.wired.com/threatlevel/2012/06/internet-security-fail/

31


Confidential

Security Threats Have Evolved…

2001

2013

AntiVirus
Firewall
IPS

AntiVirus
Firewall
IPS

Sources: Gartner, Imperva analysis
32


Confidential

Security Redefined
Forward Thinking

33


Confidential

The DISA Angle

―In the past, we’ve all been about protecting our
networks—firewall here, firewall there, firewall
within a service, firewall within an organization,
firewalls within DISA. We’ve got to remove those
and go to protecting the data‖
Lt. Gen. Ronnie Hawkins JR – DISA.
AFCEA, July 2012

34


Confidential

Rebalance Your Security Portfolio

35


Confidential

Assume You Can Be Breached

36


Confidential

Incident Response Phases for Targeted Attacks

Reduce Risk
Size Up the Target
Prevent Compromise
Compromise A User
Detection
Initial Exploration

Containment
Solidify Presence
Impersonate
Privileged User

Insulate sensitive
data
Password
Remediation

Steal Confidential Data
Device Remediation
Cover Tracks

Post-incident
Analysis
37


Confidential

Webinar Materials
Join Imperva LinkedIn Group,
Imperva Data Security Direct, for…

Post-Webinar
Discussions

Webinar
Recording Link

38

Answers to
Attendee
Questions

Join Group


Confidential

Questions?
www.imperva.com

39


Confidential

Thank You!

40


Confidential

Targeted attacks

Recommandé

Recommandé

Contenu connexe

Tendances

Tendances (20)

Similaire à Targeted attacks

Similaire à Targeted attacks (20)

Dernier

Dernier (20)

Targeted attacks

Notes de l'éditeur