Security the Wrong Way

@miscsecurity Security: We’re Doing It Wrong Brett Hardin @miscsecurity

@miscsecurity /bin/whoami • SourceNinja • Penetration Tester • Developer •
Author • Good Looking

@miscsecurity What Are We Doing Wrong?

@miscsecurity InfoSec: Science or Art?

@miscsecurity • Scientiﬁc Method • Measuring? • Hypothesizing (and stating
such) • Soft Language? Often, Most, etc. Assumption: Science

@miscsecurity Rule 1: Don’t offer opinion

@miscsecurity Verizon Data Breach Report 2010 • There wasn’t a
single conﬁrmed intrusion that exploited a patchable vulnerability • Based on evidence collected over the last six years [Verizon] wonders if we’re going about [security programs] in the most efﬁcient and effective manner.

@miscsecurity 38% + 29% = 67% Malware

@miscsecurity • [The] malware infection vector is installation or injection
by a remote attacker. This is often accomplished through SQL injection or after the attacker has root access to a system. (51%) • Drive-By Downloads (Auto Executed) 19% • User Executed (9%)

@miscsecurity Rule 2: Find the Root Cause

@miscsecurity Verizon Data Breach Report 2011 • CVE-2009-3547, CVE-2007-5156, CVE-2009-2629,
CVE-2010-0738, CVE-2007-1036 • hackers prefer other vectors or organizations are patching well. Most likely, it’s a little of both.

@miscsecurity

@miscsecurity Pro Tip: Don’t come to a conclusion where data
supports the opposite

@miscsecurity Robert Carr CEO Heartland 13 pieces of malware c
a p i t a l i z e d o n w e a k n e s s e s i n Microsoft software inﬁltrated one or more network servers. http://www.businessweek.com/technology/content/jul2009/tc2009076_891369.htm

@miscsecurity Dr. Gene Spafford Purdue University Sony was running outdated
and obsolete software on the PlayStation and Online Entertainment Networks, leaving the systems extremely vulnerable to the kind of attack that subsequently led to the breach of over 100 million customer records.

@miscsecurity Lee Morgan on Citi They simply logged on to
the part of the group's site reserved for credit card customers and substituted their account numbers which appeared in the browser's address bar with other numbers.

@miscsecurity Vulnerability Management

@miscsecurity VMs are not to be used to identify assets

@miscsecurity Comparing VMs • False Positive Rate • False Negative
Rate • Application - Spidering Ability • Aid in Remediation

@miscsecurity Reducing False Positives • Authenticated Scans • Backported Fixes
• Won’t happen • Lost “Startup” mentality

@miscsecurity What makes a good VM? • Vulnerability Discovery •
Vulnerability Classiﬁcation • Vulnerability Remediation • Vulnerability Mitigation

@miscsecurity Vulnerability Management Isn’t Helping

@miscsecurity 5 Whys

@miscsecurity

@miscsecurity Audience Participation • Who has a security program? •
Does it consist of running a vulnerability scanner against an asset and then ﬂag FPs? • What does it consist of?

@miscsecurity Rule 3: Stop trying to “solve” impossible problems.

@miscsecurity Security Programs Are Too Complex

@miscsecurity Vulnerabilities Will Always Exist

@miscsecurity The Term “Hacker”

@miscsecurity Quick Check: Do your developers code securely?

@miscsecurity Security Programs are not Mature • Afterthought. • Get
used to it. • MetaSploit

@miscsecurity Advanced Persistent Threats • “Advanced” • There is no
patch

@miscsecurity Threat Addressed By: Known Security Program Unknown Mitigating Technology
Custom Penetration Testers

@miscsecurity Penetration Testing • Is not a security process •
Should be used only after having a security process.

@miscsecurity Threat Surface 50% 25% 10% 5% 1% What %
of your threat surface does penetration testing cover?

@miscsecurity What to Measure? Do Stuff Check Metrics Did it
improve? Yes No

@miscsecurity Small Steps • Code Review? • VM? • Security
Process? • Security is Cultural

@miscsecurity Rule 3a: Don’t Teach Developers Security

@miscsecurity _____ Developers make _____ Products

@miscsecurity Rule 4: Don’t Pretend Your Something Your Not

@miscsecurity Don’t Get Frustrated • 62% of FSI think time-to-market
and the need to release products with shorter development cycles was their #1 issue. • Security is a Cost Center

@miscsecurity Most Important People • Security • Developers • Executives
• Sales • Business Development

@miscsecurity Most Important People • Security (Increase Expenses) • Developers
(Increase Profits) • Executives (Increase Profits) • Sales (Increase Profits) • Business Development (Increase Profits)

@miscsecurity Questions? [email protected]

Security the Wrong Way

Security the Wrong Way

More Decks by Brett Hardin

Other Decks in Technology

Featured

Transcript