Presentation at Networkshop46, by Dirk Schrader, Khipu.

1. www.khipu-networks.com
© 2018 Khipu Networks Limited. All Rights Reserved.
Networkshop46
The Jisc vulnerability assessment management service – part 2:
how to avoid the headline news

2. www.khipu-networks.com
© 2018 Khipu Networks Limited. All Rights Reserved.
Step 1: learn from mistakes made by others and make sure you avoid making the same
Timeline of two examples
2017-03-07
Vulnerability
CVE-2017-5638
published and patch
provided by vendor
2017-03-08
target informed
about existence of
vulnerability in own
infrastructure
2017-03-15
target does own scan,
can‘t find vulnerability,
neglects external
warnings
+/- 2017-06
breach and data
exfiltration started
(unconfirmed but
likely mid May)
2017-07-29
suspicious activity
detected
50 DAYS
2017-09-07
announcement
of breach
40 DAYS
2017-09-15
share value down
by 35%
CIO and CSO
resign
2017-09-26
CEO resigns
1st is a ‚targeted‘ attack
Add. Findings:
 Financial PII data of 145.5m people affected (15.2m from UK)
 30 (thirty) additional backdoors installed during breach
Mistakes & Lessons to be learned:
 No clarity about their data processes (90days to find out about what&who affected)
 Get this done (you have to do for GDPR, anyway)
 No good breach detection mechanism
 Monitoring, inspecting, ask us if you need help
 No clue at all about Vulnerability Management in first place
 NO COMMENT, JUST A PICTURE

3. www.khipu-networks.com
© 2018 Khipu Networks Limited. All Rights Reserved.
Step 1: learn from mistakes made by others and make sure you avoid making the same
Timeline of two examples
Summer 2016
Vulnerabilities and
Exploits leaked
+/- 2017-02-05
vendor warned by
GOV agency
2017-03-14
vendor publishes
vulnerability and
patch
2017-04-14
hacker group
publishes exploit
2017-05-12
malware outbreak
+/- 2017-06
approximately
300,000 systems
affected
2017-08-03
cash out from identified
Bitcoin wallets of 142K USD
or 420USD per transactions
on these wallets
2017-07/09
additional variants in
the wild using even
more vulnerabilities
2nd is a ‚widespread‘ attack
Some more facts on ransomware:
 54% didn‘t pay but somehow recovered data
 8% didn‘t pay and lost data
 19% paid and got the data back
 19% paid but didn‘t get the key, lost the data
Mistakes & Lessons to be learned:
 Do not underestimate the motivation for ransomware/malware
 If only 20% paid (of those 300K devices affected), that‘s a 25.2m USD gain
 Keep in mind that 99.9% of exploited vulnerabilities are known for a year, get a grip on those in
your infrastructure
 That figure doesn‘t include the other costs and effects
 Maersk reported 300m loss, 50000 devices needed re-imaging, shipping service down for 2d
 Looking at 3 exemplatory universities in UK, one day down would be 1.3m loss in rev
 No connection between Vulnerability Management and Patch Management.
Was that avoidable?
 YES, SEE A PICTURE

4. www.khipu-networks.com
© 2018 Khipu Networks Limited. All Rights Reserved.
Step 2: after step 1 – start simple, don‘t aim too high, then evolve
 keep in mind, there is no ZERO vulnerability
infrastructure, set an acceptable risk level
 look at your data processing records
(hope you have one by now)
 cut wild growth in OS and applications
 if you use an ISMS (or aim for ISO27000)
 number of critical vulns at any given point in time, time
to remediate them on critical assets
 align with patch processes and maintenance windows
 art. 30 GDPR, should indicate some of your most
critical assets, so tag them this way in your VM solution
 doing so routinely helps with art. 32 (staying compliant)
 get alerted when scanning and with CPE cross ref
 supporting each and everything helps your enemy
 it also helps you with Cyber Essentials and CEplus
(certification process)
 A.12.6. measure & A12.6.1 control

5. www.khipu-networks.com
© 2018 Khipu Networks Limited. All Rights Reserved.
Step 3: talk to your peers, our existing customers

6. www.khipu-networks.com
© 2018 Khipu Networks Limited. All Rights Reserved.
New security vulnerabilities are being discovered and exploited by cybercriminals daily. For education organisations with
large and diverse IT networks, it can be hard enough to simply understand their exposure to known vulnerabilities, let alone
try to coordinate patching and testing against them. The Vulnerability Assessment Service is designed to relieve this
pressure, and prevent outbreaks like WannaCry before they happen.”
Steve Kennet
Jisc
Using KHIPU’s Vulnerability Assessment Service helped our organisation gain its cyber essentials certification
Sean Ashford
University of Winchester
By having an automated solution that not only identifies vulnerabilities before they can be exploited, it reports on which
systems will be affected and what actions need to be undertaken to protect them. This automated approach is vital in the
defense against cyber-attacks including the recent ransomware which made headline news.
The service, provided by KHIPU Networks via the Jisc VAS framework, has been an immediate success for the University,
with a quick return on investment.”
Anglia Ruskin University
Rob Spalding

7. www.khipu-networks.com
© 2018 Khipu Networks Limited. All Rights Reserved.
Step 4: Optional but recommended, if you need to have this message delivered to your management or board....
CALL US

8. www.khipu-networks.com
© 2018 Khipu Networks Limited. All Rights Reserved.
Single Supplier Frameworks
Single Supplier Framework: www.jisc.ac.uk/vulnerability-assessment-and-information-service
Jisc Vulnerability Assessment & Information Service
Single Supplier Framework: www.jisc.ac.uk/simulated-phishing-and-associated-training
Jisc Simulated Phishing & Associated Awareness

9. www.khipu-networks.com
© 2018 Khipu Networks Limited. All Rights Reserved.
Thank you!
Any questions?
One more thing before you leave:

10. www.khipu-networks.com
© 2018 Khipu Networks Limited. All Rights Reserved.
FREE OF CHARGE Vulnerability Scan
For a limited time only, KHIPU are offering a FREE OF CHARGE service to “any” size or
type of organisation –
on a ‘first time, first served’ basis. The service includes:
 A vulnerability scan across a select number of mission critical external/internet facing hosts
 A Vulnerability Results Dynamic Report which details any vulnerabilities identified,
their severity and how to fix them
We would like to then present the results to you with an overview of the solution,
the different services available and their cost models.
Interested? Come and talk to us about at our stand.