Measuring Risk Ron Gula NSA Pen Tester Cloud Security Network IDS - - PowerPoint PPT Presentation

▶

Aug 29, 2022 154 likes •458 views

Measuring Risk Ron Gula NSA Pen Tester Cloud Security Network IDS Who is Ron Gula??? Vuln Management Cyber Companies THREAT X VULNERABILITY = RISK THREAT X VULNERABILITY = RISK Out of date browser on server One

SLIDE 1

Measuring Risk

Ron Gula

SLIDE 2

Who is Ron Gula???

NSA Pen Tester
Cloud Security
Network IDS
Vuln Management
Cyber Companies

SLIDE 3

SLIDE 4

THREAT X VULNERABILITY = RISK

SLIDE 5

THREAT X VULNERABILITY = RISK

SLIDE 6

Out of date browser on server
One server with 10 vulns versus Ten

servers with 1 vulns

“Low” and “Medium” vulns

SLIDE 7

Severity
Asset
Age
Exploit
Malware
Patch Rollups

SLIDE 8

SLIDE 9

EVEN IF WE PATCHED 100% WE STILL HAVE ZERO DAYS

SLIDE 10

Patch Management
Vuln Scanners
System Hardening
Network Monitors
EDR & Forensics
Web Proxy
GRC & Compliance
SIEM & Logs
Authentication
Asset Management
IT Provisioning
NAC and Firewall
Procurement

SLIDE 11

If you know the enemy and know yourself you need not fear the results of a hundred battles.

SLIDE 12

If you know the enemy and know yourself you need not fear the results of a hundred battles.

Complex OSes
BYOD and Mobile
On-Prem Apps
Cloud Apps
All Users
User Access

SLIDE 13

If you know the enemy and know yourself you need not fear the results of a hundred battles.

Complex OSes
BYOD and Mobile
On-Prem Apps
Cloud Apps
All Users
User Access
Vulnerabilities
Activity Logging
System Configurations
Network Monitoring
Change Detection
Privileged Access

SLIDE 14

SLIDE 15

Access Control and Authentication Can you build a map of all ACLs and enclaves?

Can you build a list

f all

enclaves and access control lists on them?

SLIDE 16

Can you build a list

f all users

and their authorized apps?

SLIDE 17

MONITORING AUDIT

SLIDE 18

DATA & APPS DATA & APPS DATA & APPS DATA & APPS DATA & APPS DATA & APPS

SLIDE 19

TELEMETRY

Logs, Packets, Flows, Cloud APIs, Auth, Files, .etc

LOOK FOR BADNESS

NIDS, AV, BOTs, UBA, NBAD, APT, .etc

AUDIT FOR GOODNESS

Apps, Users, Transactions, Normal

SLIDE 20

WHY CAN’T WE MODEL RISK?

Periodic & Imperfect Assessments
Imperfect Threat Model
Collection of Data
Lack of standards on “risk”

SLIDE 21

RISK MEASURING ENABLES

Better Security Policy
Better Security Budgets
Fact based Security

WHAT IS THE #1 THING?

SLIDE 22

FRAMEWORKS

Vendor Neutral
Cross-Organizational
Prescriptive
Written by Pen Tests & I.R.

SLIDE 23

SLIDE 24

SLIDE 25

SLIDE 26

SLIDE 27

Conclusions

CONCLUSIONS

SLIDE 28

Conclusions

CONCLUSIONS

SLIDE 29

Conclusions

CONCLUSIONS

SLIDE 30

Questions and Contact Information