Slide title 70 pt CAPITALS Slide subtitle minimum 30 pt Back to the roots – incident case study...
-
Upload
gerard-jennings -
Category
Documents
-
view
214 -
download
0
Transcript of Slide title 70 pt CAPITALS Slide subtitle minimum 30 pt Back to the roots – incident case study...
![Page 1: Slide title 70 pt CAPITALS Slide subtitle minimum 30 pt Back to the roots – incident case study Mikko Karikytö Head of Ericsson PSIRT.](https://reader034.fdocuments.us/reader034/viewer/2022042821/56649cd65503460f9499e195/html5/thumbnails/1.jpg)
Back to the roots – incident case study
Mikko KarikytöHead of Ericsson PSIRT
![Page 2: Slide title 70 pt CAPITALS Slide subtitle minimum 30 pt Back to the roots – incident case study Mikko Karikytö Head of Ericsson PSIRT.](https://reader034.fdocuments.us/reader034/viewer/2022042821/56649cd65503460f9499e195/html5/thumbnails/2.jpg)
Back to the roots - Incident case study | Commercial in confidence | © Ericsson AB 2014 | 2014-06-19 | Page 2
› Ericsson PSIRT – intro› Setting the scene› The Case
– The contact– Investigation– Aftermath
› Conclusions
outline
![Page 3: Slide title 70 pt CAPITALS Slide subtitle minimum 30 pt Back to the roots – incident case study Mikko Karikytö Head of Ericsson PSIRT.](https://reader034.fdocuments.us/reader034/viewer/2022042821/56649cd65503460f9499e195/html5/thumbnails/3.jpg)
“Constituency”
40%2.5b
180
Ericsson
![Page 4: Slide title 70 pt CAPITALS Slide subtitle minimum 30 pt Back to the roots – incident case study Mikko Karikytö Head of Ericsson PSIRT.](https://reader034.fdocuments.us/reader034/viewer/2022042821/56649cd65503460f9499e195/html5/thumbnails/4.jpg)
Back to the roots - Incident case study | Commercial in confidence | © Ericsson AB 2014 | 2014-06-19 | Page 4
› Established 2004› TI 2005› FIRST 2006› Vulnerability Management› Incident Response› Corporate group› Finland› Co-op
Ericsson PSIRT
![Page 5: Slide title 70 pt CAPITALS Slide subtitle minimum 30 pt Back to the roots – incident case study Mikko Karikytö Head of Ericsson PSIRT.](https://reader034.fdocuments.us/reader034/viewer/2022042821/56649cd65503460f9499e195/html5/thumbnails/5.jpg)
Setting the scene
![Page 6: Slide title 70 pt CAPITALS Slide subtitle minimum 30 pt Back to the roots – incident case study Mikko Karikytö Head of Ericsson PSIRT.](https://reader034.fdocuments.us/reader034/viewer/2022042821/56649cd65503460f9499e195/html5/thumbnails/6.jpg)
Back to the roots - Incident case study | Commercial in confidence | © Ericsson AB 2014 | 2014-06-19 | Page 6
The scene
E///
Managed Service Provider
Mobile Operator
“the customer”
PSIRT
![Page 7: Slide title 70 pt CAPITALS Slide subtitle minimum 30 pt Back to the roots – incident case study Mikko Karikytö Head of Ericsson PSIRT.](https://reader034.fdocuments.us/reader034/viewer/2022042821/56649cd65503460f9499e195/html5/thumbnails/7.jpg)
The case
![Page 8: Slide title 70 pt CAPITALS Slide subtitle minimum 30 pt Back to the roots – incident case study Mikko Karikytö Head of Ericsson PSIRT.](https://reader034.fdocuments.us/reader034/viewer/2022042821/56649cd65503460f9499e195/html5/thumbnails/8.jpg)
Back to the roots - Incident case study | Commercial in confidence | © Ericsson AB 2014 | 2014-06-19 | Page 8
“Hi Mikko,
Would you have a BSS specialist with deeper knowledge on the nodes? We could use one in a case with our customer…”
![Page 9: Slide title 70 pt CAPITALS Slide subtitle minimum 30 pt Back to the roots – incident case study Mikko Karikytö Head of Ericsson PSIRT.](https://reader034.fdocuments.us/reader034/viewer/2022042821/56649cd65503460f9499e195/html5/thumbnails/9.jpg)
Back to the roots - Incident case study | Commercial in confidence | © Ericsson AB 2014 | 2014-06-19 | Page 9
Finding the common frequency
![Page 10: Slide title 70 pt CAPITALS Slide subtitle minimum 30 pt Back to the roots – incident case study Mikko Karikytö Head of Ericsson PSIRT.](https://reader034.fdocuments.us/reader034/viewer/2022042821/56649cd65503460f9499e195/html5/thumbnails/10.jpg)
Back to the roots - Incident case study | Commercial in confidence | © Ericsson AB 2014 | 2014-06-19 | Page 10
Building a team and flying in
![Page 11: Slide title 70 pt CAPITALS Slide subtitle minimum 30 pt Back to the roots – incident case study Mikko Karikytö Head of Ericsson PSIRT.](https://reader034.fdocuments.us/reader034/viewer/2022042821/56649cd65503460f9499e195/html5/thumbnails/11.jpg)
Back to the roots - Incident case study | Commercial in confidence | © Ericsson AB 2014 | 2014-06-19 | Page 11
› Good overview› Too many issues included
in one report
›XXX› SIMbox
Initial investigation report
![Page 12: Slide title 70 pt CAPITALS Slide subtitle minimum 30 pt Back to the roots – incident case study Mikko Karikytö Head of Ericsson PSIRT.](https://reader034.fdocuments.us/reader034/viewer/2022042821/56649cd65503460f9499e195/html5/thumbnails/12.jpg)
Back to the roots - Incident case study | Commercial in confidence | © Ericsson AB 2014 | 2014-06-19 | Page 12
simbox
![Page 13: Slide title 70 pt CAPITALS Slide subtitle minimum 30 pt Back to the roots – incident case study Mikko Karikytö Head of Ericsson PSIRT.](https://reader034.fdocuments.us/reader034/viewer/2022042821/56649cd65503460f9499e195/html5/thumbnails/13.jpg)
Back to the roots - Incident case study | Commercial in confidence | © Ericsson AB 2014 | 2014-06-19 | Page 13
Simbox scenario
Internet
Operator A Operator BSubscriber A Subscriber B
![Page 14: Slide title 70 pt CAPITALS Slide subtitle minimum 30 pt Back to the roots – incident case study Mikko Karikytö Head of Ericsson PSIRT.](https://reader034.fdocuments.us/reader034/viewer/2022042821/56649cd65503460f9499e195/html5/thumbnails/14.jpg)
Back to the roots - Incident case study | Commercial in confidence | © Ericsson AB 2014 | 2014-06-19 | Page 14
› Obvious from beginning› Operator blaming the MS
Provider› MS Provider blaming the
operator
› Internal blame game in the Managed Service Provider
Blame game
![Page 15: Slide title 70 pt CAPITALS Slide subtitle minimum 30 pt Back to the roots – incident case study Mikko Karikytö Head of Ericsson PSIRT.](https://reader034.fdocuments.us/reader034/viewer/2022042821/56649cd65503460f9499e195/html5/thumbnails/15.jpg)
Back to the roots - Incident case study | Commercial in confidence | © Ericsson AB 2014 | 2014-06-19 | Page 15
› High pressure put on certain people
› Afraid for their jobs› Defensive mode› How to get truthful
answers?
people
![Page 16: Slide title 70 pt CAPITALS Slide subtitle minimum 30 pt Back to the roots – incident case study Mikko Karikytö Head of Ericsson PSIRT.](https://reader034.fdocuments.us/reader034/viewer/2022042821/56649cd65503460f9499e195/html5/thumbnails/16.jpg)
Back to the roots - Incident case study | Commercial in confidence | © Ericsson AB 2014 | 2014-06-19 | Page 16
![Page 17: Slide title 70 pt CAPITALS Slide subtitle minimum 30 pt Back to the roots – incident case study Mikko Karikytö Head of Ericsson PSIRT.](https://reader034.fdocuments.us/reader034/viewer/2022042821/56649cd65503460f9499e195/html5/thumbnails/17.jpg)
Back to the roots - Incident case study | Commercial in confidence | © Ericsson AB 2014 | 2014-06-19 | Page 17
Big pile of cra… findings
No policy
No processes
No
responsible
No assets
Shared accounts
No log
monitoring
No physical security
Unclear SLA
No screening of employees
![Page 18: Slide title 70 pt CAPITALS Slide subtitle minimum 30 pt Back to the roots – incident case study Mikko Karikytö Head of Ericsson PSIRT.](https://reader034.fdocuments.us/reader034/viewer/2022042821/56649cd65503460f9499e195/html5/thumbnails/18.jpg)
Back to the roots - Incident case study | Commercial in confidence | © Ericsson AB 2014 | 2014-06-19 | Page 18
› No technical vulnerability in the system itself
› Aircraft carrier size holes in operational security
– Impossible to name culprits– Shared root accounts etc…
› Nice process! When is it created?
Summary of findings
![Page 19: Slide title 70 pt CAPITALS Slide subtitle minimum 30 pt Back to the roots – incident case study Mikko Karikytö Head of Ericsson PSIRT.](https://reader034.fdocuments.us/reader034/viewer/2022042821/56649cd65503460f9499e195/html5/thumbnails/19.jpg)
Back to the roots - Incident case study | Commercial in confidence | © Ericsson AB 2014 | 2014-06-19 | Page 19
› It’s humans who run this show
› Communication flows or doesn’t
› Blame game takes time and energy
It’s a long way
![Page 20: Slide title 70 pt CAPITALS Slide subtitle minimum 30 pt Back to the roots – incident case study Mikko Karikytö Head of Ericsson PSIRT.](https://reader034.fdocuments.us/reader034/viewer/2022042821/56649cd65503460f9499e195/html5/thumbnails/20.jpg)
Mikko KarikytöHead of Ericsson PSIRT
mikko.tel
Thank you
![Page 21: Slide title 70 pt CAPITALS Slide subtitle minimum 30 pt Back to the roots – incident case study Mikko Karikytö Head of Ericsson PSIRT.](https://reader034.fdocuments.us/reader034/viewer/2022042821/56649cd65503460f9499e195/html5/thumbnails/21.jpg)