This document discusses cyber security risks in the financial and healthcare industries and their impact on homeland security. It covers three parts: examples of information disclosure vulnerabilities in access points; connecting these vulnerabilities to critical infrastructure protection and homeland security; and arguing that an asset-centric rather than product-centric approach is needed to address industry-specific security challenges.

1. FromYour Pocket, to
Your Heart, and Back
Cyber Security in the Financial and Healthcare
Industries, and How They Affect Homeland
Security!
!
Ian Amit, Director of Services

2. Hi!

15. Always remember that you are absolutely unique.!
Just like everyone else.!
Margaret Mead

16. Part I
!
Where we look at some examples

17. The RAP Console is unauthenticated and displays information about the access point. Figure 1
shows a screenshot of the RAP Console home page.
Figure 1: Unauthenticated RAP Console
On the Diagnostics tab it is possible to view the conn_log, sapd_debug, dmseg, and rapper
debug logs. The rapper debug log will log the PAP Username:

18. The RAP Console is unauthenticated and displays information about the access point. Figure 1
shows a screenshot of the RAP Console home page.
Figure 1: Unauthenticated RAP Console
On the Diagnostics tab it is possible to view the conn_log, sapd_debug, dmseg, and rapper
debug logs. The rapper debug log will log the PAP Username:
Wireless Network Penetration Testing Services
setup_tunnel
Initialized Timers
IKE_init: completed after (0.0)
(pid:16341) time:1999-12-31 16:37:53
seconds.
Before getting PSK
PSK:****** User:xiaobo1 Pass:******
A more serious information disclosure is the “Generate & save support file” option available on
the home page of the RAP Console. The support.tgz file contained 73 files, including the ikepsk,
pappasswd, and papuser files, as shown in Figure 2.

20. What’s the problem there?

21. Medical or Financial?
What’s the problem there?

22. Medical or Financial?
What’s the problem there?
Who cares?

23. Medical or Financial?
What’s the problem there?
Who cares?

30. Fairly unique to healthcare, right?!
Need to provide people access to medical facilities…
Kind’a like a financial institution needs to provide
customers access to facilities, and their money…

34. ASSETS
Traditionally protected?
Mapping all access paths?
Mapping all storage locations?
Secondary? Tertiary?…

37. Human Resources
What can it tell on your organization?
Business plans?
Access to resources?
Motivation (i.e. opportunity…)

38. Part II
!
Where we try to connect MORE dots

41. The single biggest problem in communication is
the illusion that it has taken place.!
George Bernard Shaw

42. Homeland security?
Critical Infrastructure!

43. Homeland security?
Critical Infrastructure!

44. Homeland security?
Critical Infrastructure!

45. Homeland security?
Critical Infrastructure!

46. Homeland security?
Critical Infrastructure!

47. Part III
!
Where we “disprove” what we just learned :-P

48. Always remember that you are absolutely unique. !
Just like everyone else.!
Margaret Mead
Remember this?:

49. Always remember that you are absolutely unique. !
Just like everyone else.!
Margaret Mead
Remember this?:

50. We can't solve problems by using the same kind
of thinking we used when we created them!
Albert Einstein

51. Yes, you do need your!
own special way of dealing!
with your security posture.

52. What makes me “tick”?
• What can take the
business down?!
!
• Who is involved???

53. vs.
Product Centric Threat/Asset Centric

54. Let that last one sit there for a second…
Product Centric Threat/Asset Centric

55. Let that last one sit there for a second…
Product Centric Threat/Asset Centric

56. Let that last one sit there for a second…
Produc RiskProduct Centric Threat/Asset Centric

57. Let that last one sit there for a second…
Produc Risk
Zero lateral knowledge transfer Peer knowledge transfer
Product Centric Threat/Asset Centric

58. Let that last one sit there for a second…
Produc Risk
Zero lateral knowledge transfer Peer knowledge transfer
Zero self learning (experience) Improves with practice
Product Centric Threat/Asset Centric

59. Let that last one sit there for a second…
Produc Risk
Zero lateral knowledge transfer Peer knowledge transfer
Zero self learning (experience) Improves with practice
Based on lab threats Based on real (relevant) threats
Product Centric Threat/Asset Centric

60. Let that last one sit there for a second…
Produc Risk
Zero lateral knowledge transfer Peer knowledge transfer
Zero self learning (experience) Improves with practice
Based on lab threats Based on real (relevant) threats
“Industry Best Practice” Tailored for YOUR practice
Product Centric Threat/Asset Centric

61. Product / Event
Risk / Asset
Vertical
Lateral

62. Product / Event
Risk / Asset
Vertical
Lateral

63. We all know the “how”
!
Start asking “why”!

64. We all know the “how”
!
Start asking “why”!

66. Thank YOU!
!
@iiamit