Dan [the] Salmon

Cyber Security Summit 2018 Highlights

Security Conferences

I was fortunate enough to attend the 2018 Cyber Security Summit in Minneapolis, MN. Here I’ve tried to summarize each talk I attended into a small, digestible format, mostly written in their voices.

Student Breakfast

By: Ryan Aniol - State of Minnesota

This was a super informative informal breakfast hosted by Ryan who aimed the talk at the students like myself. It was really nice to hear information directly relevant to my situation.

1. Benefits of an Information Security position

Job security

InfoSec is a huge industry and is growing in both the public and private sector. Historically, the public sector has been trailing in this regard but in the past 5 years we’ve seen a trend in public sector positions growing. Lots of jobs now.

2. Tips to Prepare Students

3. Q&A

The Most Impactful IP Theft in History – What You Need to Know About Protecting Trade Secrets

By: Brian Levine - US Department of Justice

Brian was a very good storyteller and I was so engaged in listening, I didn’t take many notes. The story of this investigation is all available online.

In this talk, Brian Levine from the Department of Justice talked about the investigation and prosecution of a Chinese wind turbine company named Sinovel.

https://www.justice.gov/opa/pr/sinovel-corporation-and-three-individuals-charged-wisconsin-theft-amsc-trade-secrets

Brian also wanted to raise awareness of the various resources available on cybercrime.gov. There you can find documents outlining best practices for incident response as well as a framework for vulnerability disclosure programs.

National Policy Conversation

By: Matthew Rhoades - Cybersecurity & Technology Program at The Aspen Institute

Matthew presented a very quick talk about national policy concerning cybersecurity. Here are his predictions for the near future.

In the near future lawmakers will:

How you prioritize threats and intelligence

By: Eric Dull - Deloitte & Touche LLP

Eric is a self-described stats nerd. He gave a great talk about gaining visibility into your network and how crucial it is.

Downtime is guaranteed to be very costly for your organization. To prepare yourself for this, you should always assume you’re going to be breached and that you’ll need to react to it.

Since you won’t be able to protect all data all the time, you’ll need to prioritize data security based on risk value. Be sure to protect sensitive data, especially that which may come under other protections such as HIPAA or FERPA over other less important things that management may have tried to prioritize such as the CEO’s emails.

In order to identify and prioritize your data, you need to have a good grasp of your network.

1. Map Your Network

Here’s the best way to map your network:

Questions you should be able to answer when you’re done:

  1. How many devices are on your network?
  2. How many DHCP addresses are in use?
  3. How many servers are on the network and which protocols are they using?
  4. What operating systems are present?
  5. What’s externally visible?

You need to have visibility to see what’s going on.

2. Threat Intel

There are hundreds of public sources, but most threat intel just points out the known worst parts of the internet. Groups like IARPA are doing work trying to predict attacks and generate intel.

Not all threats matter to you because not all threats will affect your business.

3. Plan To Act

What happens after the initial attack? You could unplug the whole network like Maersk did during the NotPetya infection.

Have something ready in addition to simple remediation. Network should be heavily segmented to reduce pivoting. You could also initiate service degradation after hours. Turning off non-production services after hours can also help reduce your attack vector.

Securing Microservices

By: Mike Gillespie - Amazon Web Services

Mike gave a really cool technical talk for those who use AWS products. AWS has a whole slew of tools built-in to it’s cloud offerings to help customers safeguard their data and protect against vulnerabilities

Monoliths - To start splitting these apart 10 years ago we started creating XML + SOAP API’s, 5 years ago we moved everything to REST, and now we have “Microservices”. Anything we can do split the application into smaller, bite-sized pieces.

In the development lifecycle, the people working on it usually fall into the following roles:

AWS

With AWS, security is a shared responsibility. Where this responsibility is split depends on the product used, but generally:

Securing VPC’s

Make sure you use tools with automation. You don’t want to be the bottleneck in your department so just script everything.

Use host-based agents

Again, automate all of this!

API Gateway

This acts as a “front door” to your microservices. It usually sits in front of:

Make sure to select and API Gateway that supports automation.

WAF - Web Application Firewall

This provides Layer 7 protection and protects against the OWASP Top 10. On AWS there are 3rd party solutions.

Best Practices for Protecting Containers

Detection Techniques

By: Tim Crothers - VP of Cyber Security at Target

Slides: GitHub

Tim had a very interesting and engaging presentation with a really cool honeypot-style strategy that’s easy enough to employ in any AD environment.

Most people would say that a “breach” occurs as soon as a phishing link is clicked. I say even if a phishing link is clicked and a RAT is installed, this is known as a “prevention failure” with the potential of a breach. A breach only occurs when the attackers accomplish their goals.

The “dwell time”, which is the time an attacker stays on a victim network, is less than a few days and with ransomware is even shorter.

Most antivirus solutions are still signature-based which is a problem. Dave Kennedy’s tool shows that it’s trivial to bypass this. The tool generates malware, submits it to an antivirus, then keeps tweaking it and checking the detection rate until it determines exactly what in the malware is triggering the antivirus. Then the author can simply change this part and become completely undetected.

Honeypot Technique

I will assert that there’s no legitimate reason for a user to dump credentials from the cache of a system. Using this rule, we can use a technique to catch attackers when they touch a system.

Using a management tool such as SCCM or even PSExec on a smaller network, we are going to cache fake credentials in the registry and memory of random desktops across the network. After caching these creds, we have make those accounts actually exist in Active Directory, but make sure to make the password >50 characters long and generated randomly. This way, AD will generate a failed login attempt.

Then, we will create alerting with Windows Event Viewer to alert on any instance of Event ID: 4771 which is Kerberos Pre-Auth Failure. Another Event ID will give you the host name of the event where the attacker tried to get in.

Cybersecurity: How Much Is Enough?

By: Tony Sager - The Center for Internet Security

Tony is a self-described old graybeard who has been around for a while. The theme for this talk was “security has become mainstream and that’s a good thing.”

The answer to “How Much Cybersecurity is enough?” is always “more”.

Risk = (vulnerability + threat + consequences) / countermeasures

Lifetime of lessons learned

Mimecast Email Talk

By: Brandon Reid - Mimecast

I liked this talk a lot because it was fairly technical. The conference advertised that there would be a live phishing demo which didn’t happen. That was a little dissapointing, but the talk was still very good.

Cybersecurity is a defense arms race.

Email attacks are effective. 90% of attacks start with a phish - it’s the most common attack vector currently used.

Originally, phishing emails were just Nigerian 419 scams. Surprisingly, these still exist.

You’re at risk of phishing if:

Even for savvy users, phishing is still possible due to:

What are some ways to fight this?

Attacks don’t need malware

Bruce Schneier: “Click Here to Kill Everybody”

By: Bruce Schneier - Legendary Cryptographer, Schneier on Security

This was essentially the only reason I came to the conference on the second day. Bruce is an amazing speaker and I was so happy to get to hear him speak. He was promoting his newest book “Click Here to Kill Everybody” which IBM sponsored by giving away free copies of and which Bruce signed.

Everything is a computer now.

  1. Most software is poorly written. It’s the old adage of good, fast, or cheap - pick any 2
  2. The Internet wasn’t designed with security in mind
  3. Extensibility of computers mean they can’t be constrained
  4. Complexity of systems mean defense is harder than offense
  5. New vulnerabilities arise as we add more inter-connections
  6. Attacks will always get better, faster, and easier

With automation comes new dangers. New ideas of smart cities could have much more serious real-world failures than just simple data breaches.

Consumer electronics are not easily updateable. That’s how we get Mirai.

We don’t yet have thing->thing authentication figured out. Just person->thing.

Supply chain risks - What software can you trust? Hardware implants?

This is a policy issue. Law and tech can subvert teach other, but defense needs to prevail.

What kind of regulatory structure do we need? The market can’t solve this. They’re going to get involved anyway. Some are already: California passed an IoT bill, New York is regulating crypto, Massachusetts is working on consumer protections.

Regulation doesn’t stifle innovation, it forces manufacturers to make it cheaper while staying within the new laws. Rising tide effect benefits people in other parts of the world when regulated somewhere else (i.e. GDPR).

Technologists need to get involved in politics. Lawmakers look really bad when they’re not technical (i.e. Facebook Senate hearing).

Q & A