DEFENDING DIGITAL BUSINESS AGAINST CYBER ATTACKS Presentation SAI - - PowerPoint PPT Presentation
www.nviso.be DEFENDING DIGITAL BUSINESS AGAINST CYBER ATTACKS Presentation SAI 21/02/2019 Our Agenda 1 Demo time 2 Threat actor groups 3 Nation states 4 Hacktivism 5 Organized cyber crime 6 The bad competitor 7 The Internet of
www.nviso.be
Presentation SAI – 21/02/2019
Our Agenda
1
Demo time
2
Threat actor groups
3
Nation states
4
Hacktivism
5
Organized cyber crime
6
The bad competitor
7
The Internet of Things and the risks
I am one of the partners at NVISO where I am responsible for a part of our Cyber Resilience Service Line. Together with my team I assist clients in developing and delivering secure network environments and applications.
I am a security consultant at NVISO, where I mainly focus on DFIR (Digital Forensics & Incident Response) and Red Team Testing engagements.
Demo time
An eye opening trip into an intrusion
Who are they and why are you their target?
Not all threat actors operate in the same way as such we need to adapt our prevention / detection / response strategy
Threat actors
www.nviso.be | 9
Who are the typical threat actors behind cyber attacks? What is their motivation / what is the ultimate goal?
Threat actors
www.nviso.be | 10
Threat actors
www.nviso.be | 11
Who are the typical threat actors behind cyber attacks?
Nation state actors
Actors sponsored and backed by a Nation State
Hacktivist groups
Actors with a political agenda
Organized cyber crime
Actors driven by profits engaged in cyber criminality
Malicious insiders and competitors
Actors operating from inside your organization or in the name
Threat actors
www.nviso.be | 12
Confidentiality Availability Integrity
Threat actors
www.nviso.be | 13
A simple exercise…
An advanced threat actor
Nation state actors
www.nviso.be | 15
Who, what, why?
Nation state actors
www.nviso.be | 16
Some Examples….
Advanced Persistent Threat (APT)
www.nviso.be | 17
What happened?
An APT is an advanced and targeted cyber attack in which an intruder gains access to a network and remains undetected for an extended period of time.
FireEye M-Trends: Beyond the breach
The above illustrations highlight two interesting statistics:
(2017);
discovered by externals
Advanced Persistent Threat (APT)
www.nviso.be | 18
How to prevent, detect, respond?
Better get serious about cyber security: Advanced attacks require a high level of maturity to identify, protect, detect, respond and recover from cyber attacks. If your organization is a target for advanced attackers, you would need to implement a proper security management system based on an internationally recognized standard.
In the crosshairs of hacktivists
Hacktivists
www.nviso.be | 20
Who, what, why?
(Distributed) Denial of Service
www.nviso.be | 21
What happened?
An attack that occurs when an attacker takes action that prevents legitimate users from accessing targeted computer systems, devices or other network resources.
DDoS attacks take down your systems
Hacktivists
www.nviso.be | 22
Some Examples
(Distributed) Denial of Service
www.nviso.be | 23
How to prevent, detect, respond?
plan ready
infrastructure
network architecture
and detection tools and services
plan
tools and services
smoke screen
Prevent Detect Respond
(Distributed) Denial of Service
www.nviso.be | 24
How to prevent, detect, respond?
Prevent Detect Respond
Show me the money
Organized Cyber Crime
www.nviso.be | 26
Some Examples….
TO ADD.
Organized Cyber Crime
www.nviso.be | 27
Some Examples….
TO ADD.
The past year we have seen ‘ransomware’ attacks
Organized cyber crime
www.nviso.be | 28
Who, what, why?
Your computer files have been encrypted. _
Ransomware
www.nviso.be | 29
What happened?
A type of computer crime which sees computers or data hijacked and a fee demanded to give them back to their owners.
Ransomware
www.nviso.be | 30
How to prevent, detect, respond?
not required
phishing emails
software
renamed
unencrypted data
protection
Prevent Detect Respond
Threat Hunting
www.nviso.be | 31
Sysmon
IoT Security
https://www.youtube.com/watch?v=BnAHfZWPaCs www.nviso.be | 38
What if it goes bad?
https://www.youtube.com/watch?v=BnAHfZWPaCs
The Internet of Things (IoT)
www.nviso.be | 39
What is it?
The Internet of things (IoT) is the network of physical devices, vehicles, home appliances and other items embedded with electronics, software, sensors, actuators, and connectivity which enables these objects to connect and exchange data. Each thing is uniquely identifiable through its embedded computing system but is able to inter-operate within the existing internet infrastructure.
The Internet of Things (IoT)
www.nviso.be | 40
Are there new risks?
Securing an IoT appliance means securing an entire
complexity introduces more room for error and vulnerabilities.
IoT Security
www.nviso.be | 41
A word of caution
The Internet of Things (IoT)
www.nviso.be | 42
What can you do?
Before buying an appliance, look for known vulnerabilities
The Internet of Things (IoT)
www.nviso.be | 43
What can you do?
Don’t expose the appliance on the internet
The Internet of Things (IoT)
www.nviso.be | 44
What can you do?
Shodan Demo
The Internet of Things (IoT)
www.nviso.be | 45
What can you do?
Think twice Be careful about what you throw out
www.nviso.be
for your interest in NVISO! Would you like to know more ? Let's get in touch!
+32 (0)2 318 58 31 info@nviso.be