Building capabilities to disrupt the adversaryyourself, you need not fear the result of a hundred...

© Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice.

Building capabilities to disrupt the adversary

Colin Gray CISSP, Sales Engineer

HP Enterprise Security Products

© Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 2

Research


APT - Definition

Asset

Well-funded and skilled attacker (teams) with profound knowledge about the target and a long-term infiltration strategy. Once the target is infiltrated the highest priority is to stay covert and exfiltrate as much sensible and valuable data as possible or to damage the target (organization) effectively and sustained. Due to the high stakes the attacker(s) will keep on trying until success.

Advanced Persistent Threat (APT)


Bank Hack Results in Stunning $45 Million ATM Heist

Experts Marvel At How Cyberthieves Stole $45 Million

Global Network of Hackers Steal $45 Million From ATMs

In Hours, Thieves Took $45 Million in A.T.M. Scheme

The Circuit: Hackers took $45 million in ATM heist


“If you know the enemy and know yourself, you need not fear the result of a hundred battles.”

—Sun Tzu, The Art of War


Big data Mobile Cloud


I follow ISO, PCI and other security standards

Our predictability is well known

I stitch technology together across functions


Market with distinct process

Actors organize and specialize

Intelligence is bought and sold

Defining the adversary

Cybercrime

Economic Espionage

Hacktivist

The

adversary


Discovery

Organize our capability to disrupt the market

Research

Our enterprise

Their ecosystem

Infiltration

Capture

Exfiltration


Discovery


Research

Our enterprise

Their ecosystem

Infiltration

Capture

Exfiltration

Educating users Counter intel

Blocking access


84% of breaches occur at the application layer

68% increase in mobile application vulnerability disclosures


Discovery

Rethink our capability investments

Research

Our enterprise

Their ecosystem

Exfiltration

Capture

5X 1X

Infiltration


Discovery


Research

Our enterprise

Their ecosystem

Infiltration

Capture

Exfiltration

Finding them


Blocking access


average time to detect breach 416 days

2012 January February March April May June July August September October November December 2013 January February March April


Discovery


Research

Our enterprise

Their ecosystem

Infiltration

Capture

Exfiltration Planning damage mitigation

Protecting the target asset

Finding them


Blocking access


of breaches are reported by a 3rd party 94%


We are here to help

1. SOC Consulting Services

2. Security Information and Event Management a. ArcSight

3. Application vulnerability protection a. TippingPoint IPS / NGFW

b. Fortify Application Assurance


Make it matter.

Thank you

Building capabilities to disrupt the adversaryyourself, you need not fear the result of a hundred...

Documents

Transcript of Building capabilities to disrupt the adversaryyourself, you need not fear the result of a hundred...