Game Changing Cyber Defensive Strategies for 2019

1
GAME-CHANGING DEFENSIVE
STRATEGIES FOR 2019
Sponsored by Fidelis
1
© Copyright 2019 SANS Institute

Today’s Speakers
ALISSA TORRES
Analyst &
Principal Instructor
SANS Institute
Dr. ABDUL RAHMAN
Chief Scientist
Fidelis Cybersecurity
TOM CLARE
Product Strategy
Fidelis Cybersecurity
© Copyright 2019 SANS Institute 2

• The fabric of the enterprise has morphed and now
includes cloud, mobile, IoT of all types in addition to
the traditional managed assets
• A shift in security mindset is required to perform
accurate risk assessment on today’s environments and
to anticipate future threats
Evolving Defensible Assets:
what is a network comprised of?

What device
types are
connecting
to your
network or
part of your
network?
Are they
included in
your security
programs?
SANS Endpoint Security Survey 2018

• With the increase in mobile, cloud & IoT devices,
today’s enterprises are effectively de-perimeterized
• Old boundaries of “inside” and “outside” or “trusted”
and “untrusted” no longer apply
• Successful defense is achieved with multiple
prevention and detection solutions
What is Defensible Security Architecture?

• Leverage & harden current infrastructure (switches,
routers & firewalls)
• Harden systems & networks at every layer from physical
to application & data
• Greenfielding a network not realistic, most enterprises
are comprised of entrenched legacy technologies
• Private VLANS, Network Access Control, 802.1x
Evolution of Best Practices for Defensible
Security Architecture

• Cost of additional rework caused by choosing an easy
solution now instead of a better approach that work take
longer
• Can there be smart technical debt?
• How does it relate to defensible security architecture?
Best Practices for Defensible Security Architecture
Quantify Technical Debt

• Network is presumed compromised
• Role-based Access, every user, every device
must be validated/authenticated
• Log and Inspect all traffic
• Network access control - device hygiene
• Moving towards this requires a roadmap with
identified milestones (ex. PVLAN)
Zero-Trust Architecture

• Cloud-hybrid networks growing, making for a
complex and difficult defend attack surface
Perimeter-less Networks
9

• Most enterprises are heterogeneous with both
modern and legacy technologies that require
integration.
• Backward compatibility requirements for modern
technologies can create vulnerabilities.
 Identify Business Use Case
 Harden & Monitor
Technology Integrations

• Continuous security
monitoring with critical
log archival
• Identify and categorize
assets
 Critical
 Non-viable
 Unmanaged
Enterprise Auditing

• Map normal internal/external network/device activity:
 Host-to-Host
 User agents
 Protocols
 Services
• Determine normal use and abuse cases for systems.
• Design controls to monitor and detect anomalies.
 Netflow/Bandwidth Utilization
 System Resource Utilization
 User/Entity Behavior Analytics
 Security Operations Procedures
 Application Interactions & Data Flow
Create Enterprise Baselines
12

• Host-based IDS/IPS
 File Integrity Monitoring
 Signature-based Detection
 Heuristic-based Detection
• Host-based Firewalls
 Port modifications
 Lateral movement Detection
• Endpoint Detection &
Response (EDR)
• Exploit Detection &
Mitigation Technologies
• Endpoint Auditing &
Aggregation
Correlate Endpoint & Network Sensor Data
13

Endpoint Data Collection
14

Requirements for Successful Deception
Implementations
Centralized
Management
Decoy Auditing
Low Threshold to Entry
Decoys require monitoring and management to be
effective
Activity occurring on decoy systems must be
monitored and collected for threat intel consumption
Decoys must be complex enough to appear
authentic but easy to deploy & monitor

“Cyber terrain exists across the cyberspace planes and there are
many features of cyber terrain that can provide an advantage to one
side or the other. By understanding this cyber key terrain, a network
defender knows where to focus his energy to prevent penetration and
an attacker can select a target within a network that provides
maximum potential for success.”
D. Raymond, G. Conti, T. Cross, and M. Nowatkowski, “Key terrain in cyberspace:
Seeking the high ground,” in Cyber Conflict (CyCon), 2014 6th International
Conference on, June 2014.
What is Key Terrain in Cyber Space?

Defensive Cyber Battlefield

Define your terrain: Asset Database = Facilitate Hunt

SANS Center for Internet Security Controls

CIS Basic Controls
Understand your terrain

CIS Foundation Controls

Fundamentals of Cyber Analysis

Quantity of
Exploitable
Terrain
Quantity of
Total Terrain
Lower this number
by patching
vulnerabilities,
decommissioning
Increase this number
by deploying
unexploitable terrain
(i.e. decoy hosts)
Percentage of
Exploitable
Terrain
Cyber Protection should seek to understand
and lower the percentage of exploitable terrain

• Asset classification & profiling (Cyber Terrain)
• Network deep session inspection (DSI)
 All ports, known protocols, content, recursive file extraction
 DLP at gateways, internal networks, email and web gateways
 Metadata and custom tags for real-time & retrospective analysis
 Threat prevention, detection, and threat hunting
• Endpoint prevention, detection and response
 SW Inventory, Known Vulnerabilities, Process/Event Metadata
• Deception layers of breadcrumbs & decoys
• Cloud-sandboxing, threat intelligence/research
• MDR and IR services
Fidelis Provides…

The Fidelis Architecture

from the most trusted name in information security
Q&A
3
1

Game Changing Cyber Defensive Strategies for 2019

Recomendados

Recomendados

Mais conteúdo relacionado

Mais procurados

Mais procurados (20)

Semelhante a Game Changing Cyber Defensive Strategies for 2019

Semelhante a Game Changing Cyber Defensive Strategies for 2019 (20)

Último

Último (20)

Game Changing Cyber Defensive Strategies for 2019