Evade The Breach

Change the way you think about information security

Transcript

1. EVADE THE BREACH BY CHANGING THE WAY YOU THINK ABOUT INFORMATION SECURITY MAJOR HAYDEN RACKSPACE @majorhayden FOR ACCRUENT INSIGHTS 2014, AUSTIN, TEXAS PHOTO CREDIT: CURTIS GREGORY PERRY [bit.ly/1k5ajws]
2. ABOUT MAJOR • Born in Austin • At Rackspace since 2006 • Focused on Linux engineering, software development and information security • Two kids and four chinchillas
3. THIS IS A CHINCHILLA THEY ARE AMAZING PETS AND I COULD TALK ABOUT THEM FOR A LONG TIME
4. AGENDA Presentation 30 minutes Q&A 30 minutes
5. Let's cover some critical concepts
6. SECURITY ISN'T EASY
7. YOUR BUSINESS DOESN'T EXIST TO BE SECURE INSPIRED BY KEITH PALMGREN'S "13 ABSOLUTE TRUTHS OF SECURITY"
8. SECURITY HAS NO FINISH LINE INSPIRED BY KEITH PALMGREN'S "13 ABSOLUTE TRUTHS OF SECURITY"
9. Reports that say...that something hasn't happened are always interesting to me, because as we know, ! there are known knowns; there are things that we know that we know. We also know there are known unknowns; that is to say we know there are some things we do not know. ! But there are also unknown unknowns, the ones we don't know we don't know.
 
 —Donald Rumsfeld, United States Secretary of Defense PUBLIC DOMAIN PHOTO BY THE UNITED STATES ARMY
10. THREE DEFENSIVE LAYERS Preventative Make yourself a hard target Detective Know when danger is on your doorstep Corrective Remove the threat and repair the damage PROCESS IMPROVEMENT ! FEEDBACK LOOP
11. We can apply these layers to something we all know well
12. How do we protect our homes? PHOTO CREDIT: DPREVITE [bit.ly/1mC8QBi]
13. PHOTO CREDIT: DPREVITE [bit.ly/1mC8QBi] We lock our doors We put our lights on timers We close the blinds We install security cameras We join the neighborhood watch We set our security alarm We have our alarm monitored We buy homeowner's insurance ! We buy firearms* *
14. PHOTO CREDIT: DPREVITE [bit.ly/1mC8QBi] We lock our doors We put our lights on timers We close the blinds We install security cameras We join the neighborhood watch We set our security alarm We have our alarm monitored We buy homeowner's insurance ! We buy firearms PREVENTATIVE
15. PHOTO CREDIT: DPREVITE [bit.ly/1mC8QBi] We lock our doors We put our lights on timers We close the blinds We install security cameras We join the neighborhood watch We set our security alarm We have our alarm monitored We buy homeowner's insurance ! We buy firearms DETECTIVE
16. PHOTO CREDIT: DPREVITE [bit.ly/1mC8QBi] We lock our doors We put our lights on timers We close the blinds We install security cameras We join the neighborhood watch We set our security alarm We have our alarm monitored We buy homeowner's insurance ! We buy firearms CORRECTIVE
17. You now know two other concepts
18. DEFENSE IN DEPTH ASSUME THE WORST AND BUILD LAYERS OF DEFENSE PHOTO CREDIT: SZEKE [bit.ly/1mxjkzl]
19. RISK MANAGEMENT INVEST YOUR TIME SPENT ON SECURITY WISELY PHOTO CREDIT: LORENZOCLICK [bit.ly/1f40rns]
20. Do your third party vendors invest in security as much as you do?
21. How will you know for sure?
22. IT'S NOT EASY PHOTO CREDIT: KEVIN DOOLEY [bit.ly/1ri0hej]
23. Let's review the facts
24. "Target gave network access to a third-party vendor, a small Pennsylvania HVAC company, which did not appear to follow broadly accepted information security practices. The vendor’s weak security allowed the attackers to gain a foothold in Target’s network."
25. "Target appears to have failed to respond to multiple automated warnings from the company’s anti-intrusion software that the attackers were installing malware on Target’s system."
26. "Attackers who infiltrated Target’s network with a vendor credential appear to have successfully moved from less sensitive areas of Target’s network to areas storing consumer data, suggesting that Target failed to properly isolate its most sensitive network assets."
27. "Target appears to have failed to respond to multiple warnings from the company’s anti-intrusion software regarding the escape routes the attackers planned to use to exfiltrate data from Target’s network."
28. What can we learn from the Target breach?
29. Target's situation isn't unique to Target
30. It's your responsibility to insulate yourself from third parties
31. Continually test your security layers so you can trust them in an emergency
32. What about the vendors that don't show up on your books? PHOTO CREDIT: CLASPINGWALNUT [BIT.LY/1K5J5DT]
33. HOW ABOUT THE OPENSSL SOFTWARE FOUNDATION?
34. HEARTBLEED: A QUICK SUMMARY • Small coding error allows attackers to steal chunks of memory from remote servers • Attackers repeatedly send requests to get different data from the server • Announcement of the vulnerability was handled extremely poorly • Much of the internet is still still vulnerable almost a month after the announcements
35. HEARTBLEED: LESSONS LEARNED Layer your defenses Segregate server duties Make emergency plans
36. Rackspace has joined many other companies in support of the Core Infrastructure Initiative that provides funding for open source projects that need assistance
37. LET'S WRAP IT UP PHOTO CREDIT: TANAKAWHO [bit.ly/1mxiEd3]
38. Three takeaways: (Or, if you fell asleep during the last half hour, here's what I was talking about)
39. 1. Layer your defenses
40. 2. The security of your business is your business
41. 3. Better security requires changes in people, process, and technology
42. THANK YOU! ! PHOTO CREDIT: STUCK IN CUSTOMS [bit.ly/1k5nqha] Blog: major.io Twitter: @majorhayden Email: major.hayden@rackspace.com