SANS Threat Hunting and Incident Response Summit - There is no magic fairy dust.

Every organization is desperately seeking solutions to the “inevitability of compromise.” Despite increased investment in recent years, targeted attackers are still successful, and most organizations are struggling to keep up. Since so many practitioners still don’t understand attackers and their methodologies, they’re asking industry vendors to be the smart guys in the basement and sell them a magic bullet solution with secret-sauce-magic fairy-dust that will make it go away. In truth, there is no magic fairy dust - but we must stand up, cut through the FUD and educate our organizations on the truth from the trenches.

YouTube recording here: https://www.youtube.com/watch?v=TLPM0ZQYId8

Transcript

1. There  is  no   magic  fairy J.J.  Guy           /in/jjguy   @jjguy
2. 1999  -­‐  2005 2005  -­‐  2012 2012  -­‐  2017 USAF  Red  &  Blue  Team Intel  /  Offensive  Network  Ops Founding  Team  of  Cb
3. 3 INFOSEC  in  2017
4. 1995 Mb – The monetary benefit of committing the crime Pb – The psychological benefit of committing the crime Ocm – Opportunity cost of committing the crime (overcoming obstacles, time spent, etc) Ocp – Psychological & prosecution cost of committing the crime (fear, time lost from punishment) Pa – Probability of apprehension Pc – Probability of conviction
6. Manage -> board level topic •  Board -> risk to BAU •  Why not BAU today? I © 2016 Carbon Black. All Rights Reserved. I CONFIDENTIAL 6 Managing  risk  is  “business   as  usual”  for  the  board…   except  security.    Why?
7. People Processes Products People Processes Products Security  will  never  be  solved  un\l  we  stop  trying  to  fix  it. We  are  seeking  a  magic  product   that  will  fix  security. Solving  security  takes  a   combina\on  of  all  three. WE  MUST  GROW
8. YOU MUST LEAD
9. I © 2016 Carbon Black. All Rights Reserved. I CONFIDENTIAL 9 ESSENTIAL  LESSONS     OF  LEADERSHIP You  can  make  a  difference Credibility  is  the  founda\on  of   leadership
10. together   we  can  change  our  world.
11. Fix  v.  manage  –  security  can’t  be  fixed. Remember No  magic  fairy  -­‐  we  will  never  advance  un\l  we  accept  it. Leadership  -­‐  credibility  is  the  founda\on  of  leadership. Responsibility  -­‐  your  exper\se  gives  you  unparalleled  credibility.   Grit  –  solu\ons  won’t  be  easy
12. QUESTIONS? J.J.  Guy   /in/jjguy   @jjguy