Measuring Risk Ron Gula NSA Pen Tester Cloud Security Network IDS - PowerPoint PPT Presentation

Measuring Risk Ron Gula

• NSA Pen Tester • Cloud Security • Network IDS Who is Ron Gula??? • Vuln Management • Cyber Companies

THREAT X VULNERABILITY = RISK

THREAT X VULNERABILITY = RISK

• Out of date browser on server • One server with 10 vulns versus Ten servers with 1 vulns • “Low” and “Medium” vulns

• Severity • Exploit • Asset • Malware • Age • Patch Rollups

EVEN IF WE PATCHED 100% WE STILL HAVE ZERO DAYS

• Patch Management • Vuln Scanners • System Hardening • Network Monitors • EDR & Forensics • Web Proxy • GRC & Compliance • SIEM & Logs • Authentication • Asset Management • IT Provisioning • NAC and Firewall • Procurement

If you know the enemy and know yourself you need not fear the results of a hundred battles.

If you know the enemy and know yourself you need not fear the results of a hundred battles. • Complex OSes • BYOD and Mobile • On-Prem Apps • Cloud Apps • All Users • User Access

If you know the enemy and know yourself you need not fear the results of a hundred battles. • Complex OSes • Vulnerabilities • BYOD and Mobile • Activity Logging • On-Prem Apps • System Configurations • Cloud Apps • Network Monitoring • All Users • Change Detection • User Access • Privileged Access

Can you build a list of all Access Control and Authentication enclaves Can you build a map of all ACLs and enclaves? and access control lists on them?

Can you build a list of all users and their authorized apps?

MONITORING AUDIT

DATA DATA DATA & APPS & APPS & APPS DATA & APPS DATA & APPS DATA & APPS

TELEMETRY Logs, Packets, Flows, Cloud APIs, Auth, Files, .etc LOOK FOR BADNESS NIDS, AV, BOTs, UBA, NBAD, APT, .etc AUDIT FOR GOODNESS Apps, Users, Transactions, Normal

WHY CAN’T WE MODEL RISK? • Periodic & Imperfect Assessments • Imperfect Threat Model • Collection of Data • Lack of standards on “risk”

RISK MEASURING ENABLES • Better Security Policy • Better Security Budgets • Fact based Security WHAT IS THE #1 THING?

FRAMEWORKS • Vendor Neutral • Cross-Organizational • Prescriptive • Written by Pen Tests & I.R.

CONCLUSIONS Conclusions

CONCLUSIONS Conclusions

CONCLUSIONS Conclusions

Questions and Contact Information