Network Defender First Principles · 2016. 11. 17. · Network Defender Problem Space First...

Network Defender First Principles

Rick Howard - CSO

Source: Bruno Oliveira

Geeks vs Non-Geeks: Reaction to flaky internet connection

Time

Hope



Time

Hope



Y-Axis: Hope

Time

Hope



X-Axis: Time

Time

Hope



Geek Non-Geek

Time

Hope



Geek Non-Geek

Non-Geeks – The Beautiful People

Time

Hope



Geek Non-Geek


I’ll just wait a bit; maybe it will come back

Time

Hope



Hmmm … this is taking too long

Geek Non-Geek


Time

Hope



Geek Non-Geek


Call the ISP

Time

Hope



Geek Non-Geek


Call the ISP

They Are Always so Helpful

Time

Hope



Geek Non-Geek

Call the ISP


Time

Hope



Geek Non-Geek


Call the ISP

Time

Hope



Geek Non-Geek

Geeks – My Peeps

Time

Hope



Geek Non-Geek

Geeks – My Peeps

Reload

Time

Hope



Geek Non-Geek

Geeks – My Peeps

ReloadReload

Time

Hope



Geek Non-Geek

Geeks – My Peeps

ReloadReload

Try Another Site

Time

Hope



Geek Non-Geek

Geeks – My Peeps

ReloadReload

Try Another Site Reload

Time

Hope



Geek Non-Geek

Geeks – My Peeps

ReloadReload


Check network settings

Time

Hope



Geek Non-Geek

Geeks – My Peeps

ReloadReload



Switch WiFiOn/Off

Time

Hope



Geek Non-Geek

Geeks – My Peeps

ReloadReload



Switch WiFiOn/Off

That will fix everything

Time

Hope



Geek Non-Geek

Geeks – My Peeps

ReloadReload



Switch WiFiOn/Off


!@#^!@&^

Time

Hope



Geek Non-Geek

Geeks – My Peeps

ReloadReload



Switch WiFiOn/Off


!@#^!@&^

pingifconfig

rebootdmesgtraceroute

iptables

Time

Hope



Geek Non-Geek

Geeks – My Peeps

ReloadReload



Switch WiFiOn/Off


!@#^!@&^

pingifconfig


iptables


Time

Hope



Geek Non-Geek

Geeks – My Peeps

ReloadReload



Switch WiFiOn/Off


!@#^!@&^

pingifconfig


iptables


Call the ISP

Time

Hope



Geek Non-Geek

Geeks – My Peeps

ReloadReload



Switch WiFiOn/Off


!@#^!@&^

pingifconfig


iptables


Call the ISP

They Are Always so Helpful

Time

Hope



Geek Non-Geek

Geeks – My Peeps

ReloadReload



Switch WiFiOn/Off


!@#^!@&^

pingifconfig


iptables


Call the ISP

Time

Hope



ReloadReload




Switch WiFiOn/Off

ping

!@#^!@&^

ifconfig


iptables


Hmmm … this is taking too long

Call the ISPCall the ISP

Geek Non-Geek

AUTHORITY: FEAR UNCERTAINTY AND DOUBT COMMITTEE

STATE OF CALIFORNIA

ElonMusk

What is a First Principle?

Principia Mathematicapublished in 1913

Principia Mathematicapublished in 1913


Analogy vs First Principle

Leap Ahead

Analogy vs First Principle

Semantic Tree

Trunk

Semantic Tree

Limbs

Semantic Tree

LeavesSemantic Tree

Fundamental


Fundamental

SelfEvident


Fundamental

SelfEvident

ExpertsAgree


Fundamental

SelfEvident

ExpertsAgree

Atomic


Fundamental

SelfEvident

ExpertsAgree

Atomic

New


Fundamental

SelfEvident

ExpertsAgree

Atomic

New

FirstPrinciples



1+1=2

1+1=2

*Note:Mightbeusefultoknow


Network Defender Problem SpaceTh

ird In

nova

tion

1994

First Intrusion Detection System

1985 1987 2004 2007 2010 2014

Third

Inno

vatio

n

1994


1985

First Anti-Virus System

1987 2004 2007 2010 2014

Network Defender Problem Space

Third

Inno

vatio

n

1994

First Firewall


1985


1987 2004 2007 2010 2014


Third

Inno

vatio

n

1994

First Firewall


1985


1987

First Detection System

2004 2007 2010 2014


Third

Inno

vatio

n

1994

First Firewall


1985


1987 2004 2006 2010 2014

First Data Loss Protection Systems



Third

Inno

vatio

n

1994

First Firewall


1985


1987 2004


2006 2010 2014



Third

Inno

vatio

n

1994

First Firewall


1985


1987 2004 2007 2010 2014




Third

Inno

vatio

n

1994

First Firewall


1985


1987 2004 2007 2010 2014

Leap Ahead




Third

Inno

vatio

n

1994

First Firewall


1985


1987 2004 2007 2010 2014




Prefatory First Principle Statements

Victim


Threats

Wow! That’s a lot!

?


Risk Matrix


X-Axis: Likelihood


Risk Matrix

Y-Axis: Impact


Risk Matrix

What is a Network Defender First Principle?

Whatisit?


Whatisit?

Whatshoulditbe?


Whatisit?

Whatshoulditbe?

Whatdoweagreethatitshoulditbe?


“Wemustidentifythetrunkandthebigbranchesfirstsothatwhenwediscovertheleaveslater,wewillhavesomethingtohangthemon.”


Network Defender Semantic Tree

1Trunk


5Limbs


Leaves


The Trunk

Network Defender Semantic Tree: The Trunk

Trunk


PreventHighRiskMaterialImpactTrunk


Trunk


High ProbabilityTrunk


High damage

TrunkHigh Probability


PreventHighRiskMaterialImpact


The First Limb

Network Defender Semantic Tree: First Limb

EstablishaRobustThreatPreventionprogram

Limb

NEW


Victim


IndicatorsofCompromise areforensicartifactsthatdescribeanadversary’smethodology;digitalcluesleftbehindbytheadversarygroupasitworksitswaythroughthephasesoftheattacklifecycle.


Theattacklifecycle isaphasedmodelthatdescribesthetasksanadversarygroupmustaccomplishinordertocompletetheirmission


MOST


ThreatPrevention istheactofturningknownindicatorsofcompromiseintooneormoredeployedpreventioncontrols.


Precision


99% Guarantee



1st Limb


The Second Limb

EstablishaRobustThreatDetectionProgram

Limb

Network Defender Semantic Tree: 2d Limb


178


179


2nd Limb


The Third Limb

EstablishaRobustThreatEradicationProgram

3rd Limb

Network Defender Semantic Tree: 3rd Limb

Threateradication istheactofminimizing theeffectivenessofnewlydiscoveredadversarycampaignactivitybyblocking futureactivitythroughtheThreatPreventionprogram,analyzingthepurposeofthisnewcampaign,andinstallingadditionalcountermeasuresthatwilllikelythwarttheaccomplishmentofthecampaignobjectives.


Threateradication istheactofminimizingtheeffectivenessofnewlydiscoveredadversarycampaignactivitybyblockingfutureactivitythroughtheThreatPreventionprogram,analyzingthepurposeofthisnewcampaign,andinstallingadditionalcountermeasuresthatwilllikelythwarttheaccomplishmentofthecampaignobjectives.

Impact Mitigation



3rd Limb


The Fourth Limb

CreatetheNetworkDefender’sTrinity.

4th Limb

Network Defender Semantic Tree: 4th Limb

Inextricablylinked


Trinity


CreatetheNetworkDefender’sTrinity.

4thLimb


The Last Limb

Embracecybersecurityintelligencecollectionandubiquitoussharing

5thLimb


Collected


Collected

Sorted


Collected

Sorted

Evaluated


Collected

Sorted

Evaluated

Prioritized


Intelligencecollection istheactofgatheringIndicatorsofCompromise fromnetworkandendpointsystemsthroughouttheenterpriseanddiscoveringanysupplementalinformationfrominternalandexternalsourcesthatcanaddcontextaboutwhattheadversarygroupisabout.



Maximize

BenefitsAll



Benefits


Limb


The Cyber Threat Alliance

Founding CEOs

Mark McLaughlin Michael Brown Ken Xie Chris Young

Founding Members:

Purpose: The Cyber Threat Alliance is a group of cyber security practitioners that have chosen to share threat information with each other for the purpose of improving defenses against advanced cyber adversaries across member organizations and their customers.

Rick Howard Vishaal Hariprasad Derek MankyJoe Chen Jeannette JarvisVincent Weafer

Working Committee

2 Initial Issues

Build Trust

Build Infrastructure

Rick Howard Vishaal Hariprasad Derek MankyJoe Chen Jeannette JarvisVincent Weafer

New Contributing Members:

Membership: Open to any organization that can share a minimum volume of threat intelligence designed by the Alliance.

New Contributing Members:

Membership: Open to any organization that can share a minimum volume of threat intelligence designed by the Alliance.

White House Summit on Cybersecurity and Consumer Protection held at Stanford University

Two Unique Organizing Principles:

• Must Contribute.

• Whatever is shared goes directly into the product line.

Result: Automatic Prevention Controls.


Founding CEOs

The only smart thing for the network defender to do is to share everything; crowd source threat intelligence so that only the advanced adversary can keep up.K

ey T

ake-

Aw

ay:

Shar

e Ev

eryt

hing

Where We Need to Go

Conclusion

Third

Inno

vatio

n

1994

First Firewall


1985


1987


2004 2007 2010 2014


25 Years of Incremental Improvement

Rethink the Network Defender Problem Space

Leap Ahead

Third

Inno

vatio

n

ElonMusk


Fundamental

SelfEvident

ExpertsAgree

AtomicFirstPrinciples


Semantic Tree

Limbs

Trunk


PreventHighRiskMaterialImpact


1st Limb



2nd Limb



3rd Limb


TheNetworkDefender’strinityisinextricablylinked,atomic,andirreducible

4th Limb



5th Limb


More Information

Rick Howard: CSO Palo Alto NetworksEmail: [email protected]: @raceBannon99

https://paloaltonetworks.com/threat-research.html

https://paloaltonetworks.com/threat-research/cybercanon.html

http://cyberthreatalliance.org/

Con

tact

Info

rmat

ion

Call to Action

First Principle White Paper:http://researchcenter.paloaltonetworks.com/2016/03/first-principles-for-network-defenders-a-unified-theory-for-security-practitioners/

Network Defender First Principles · 2016. 11. 17. · Network Defender Problem Space First...

Documents

Transcript of Network Defender First Principles · 2016. 11. 17. · Network Defender Problem Space First...