Ga society of cpa's 2018 coastal chapter
•Descargar como PPTX, PDF•
0 recomendaciones•20 vistas
Presentation given to Coastal GA CPA Chapter. Spreading awareness about Cyber Security Threats in the cloud.
Recomendados
Recomendados
Más contenido relacionado
Similar a Ga society of cpa's 2018 coastal chapter
Similar a Ga society of cpa's 2018 coastal chapter (20)
Más de Greg Wartes, MCP
Último
Último (20)
Ga society of cpa's 2018 coastal chapter
- 1. 1©2018 Check Point Software Technologies Ltd.©2018 Check Point Software Technologies Ltd. Tuesday, August 15th , 2018 Evolving Threats Layered Security
- 2. 2©2018 Check Point Software Technologies Ltd. Greg Wartes – GA Account Manager – Check Point Software Technologies • Husband | Father of 3 • Microsoft Certified Professional • Aspiring Writer/Blogger • Former Golf Professional Magazine WHITE PAPERS CASE STUDIES Published In: gwartes@checkpoint.com
- 3. 3©2018 Check Point Software Technologies Ltd. Who is Check Point? HQ in Tel-Aviv, Israel CEO – Gil Shwed, inventor of the firewall In business 25 years Pure Cyber-Security Company
- 4. 4©2018 Check Point Software Technologies Ltd. Look at YOUR Organization/Data Differently!! INTENTION:
- 5. 5©2018 Check Point Software Technologies Ltd. Context/Definitions Matter:
- 6. 6©2018 Check Point Software Technologies Ltd. Definitions Matter:
- 7. 7©2018 Check Point Software Technologies Ltd. Definitions Matter:
- 8. 8©2018 Check Point Software Technologies Ltd.
- 9. 9©2018 Check Point Software Technologies Ltd. The Game Has Changed! Law No. 1: If There Is A Vulnerability, It Will Be Exploited Law No. 2: Everything Is Vulnerable In Some Way Law No. 3: Humans Trust Even When They Shouldn't Law No. 4: W/ Innovation Comes Opportunity For Exploitation Law No. 5: When In Doubt, See Law No. 1 : The Five Laws Of Cybersecurity
- 10. 10©2018 Check Point Software Technologies Ltd.
- 11. 11©2018 Check Point Software Technologies Ltd. How Serious Are The Cyber Threats In 2018?
- 12. 12©2018 Check Point Software Technologies Ltd. https://threatmap.checkpoint.com/ThreatPortal/livemap.html
- 13. 13©2018 Check Point Software Technologies Ltd. Threats are evolving…..
- 14. 14©2018 Check Point Software Technologies Ltd. Definitions Matter:
- 15. 15©2018 Check Point Software Technologies Ltd. Definitions Matter:
- 16. 16©2018 Check Point Software Technologies Ltd. 16©2018 Check Point Software Technologies Ltd. Generations of Attacks and Protections Gen I Late 1980s – PC attacks - standalone Virus Gen II Mid 1990s – Attacks from the internet Networks Gen III Early 2000s - Exploiting vulnerabilities in applications Applications The Anti Virus The Firewall Intrusion Prevention (IPS) Gen IV 2010 - Polymorphic Content Payload SandBoxing and Anti-Bot
- 17. 17©2018 Check Point Software Technologies Ltd. [Internal Use] for Check Point employees Where are we ? 1990 2000 2010 2015 2017 THREATS PROTECTIONSNetworks Gen II Applications Gen III Payload Gen IV GRADE I GRADE II GRADE III GRADE V GRADE IV Virus Gen I Enterprises are between Gen 2-3 2.8 Mega Gen V
- 18. 18©2018 Check Point Software Technologies Ltd. Quick Story: Thursday - March 22nd, 2018 8:30a.m. Thursday - March 22nd, 2018 8:55a.m. Jim X – Business Accounting Professional of 18 years: 1. 3. 2. Process: 1. 6M customers affected 8,000 employees affected 5 FULL Days! Multiple Dpts. Around the clock hours worked Partner dependence Day-to-day Operations/Process = MANUAL
- 19. 19©2018 Check Point Software Technologies Ltd. By Show of hands……
- 20. 20©2018 Check Point Software Technologies Ltd. “In The Room” 300 miles
- 21. 21©2018 Check Point Software Technologies Ltd. March 22nd, 2018 $51,000 ransom • The city’s police department reported that most of its video evidence (mostly dashcam videos) have been lost. • More than 140 separate applications were totally or partially disabled by the attack (nearly 30 percent of the affected programs were “mission critical”). • After an initial estimated cost of $2 million, the city will need an additional $9.5 million to recover
- 22. 22©2018 Check Point Software Technologies Ltd. What is it costing? At The End of 2017, Global Ransomware Damage Cost Exceeded $5 Billion
- 23. 23©2018 Check Point Software Technologies Ltd. RENTAL CAR – YOUR CLOUD:
- 24. 24©2018 Check Point Software Technologies Ltd. What’s in Your “CAR?” YOUR
- 25. 25©2018 Check Point Software Technologies Ltd. What are you doing to protect your “CAR?”
- 26. 26©2018 Check Point Software Technologies Ltd. YOU Still have responsibility
- 27. 27©2018 Check Point Software Technologies Ltd. OUR CLOUD ENVIRONMENT Internet
- 28. 28©2018 Check Point Software Technologies Ltd. WITHIN THE FIRST 15 MINUTES149 Attacks: • 92 SSL Attacks • 1 Scripting attack7 TCP Attacks • 49 Network based attacks
- 29. 29©2018 Check Point Software Technologies Ltd. AFTER 7 DAYS . . . Oh won’t you please be my neighbor . . . ~4 million attacks recorded!
- 30. 30©2018 Check Point Software Technologies Ltd. WARNING THE NEXT COUPLE OF SLIDES MAY CONTAIN TECHNICAL CONTENT SIDE EFFECTS MAY CAUSE SLEEPINESS…..WAKE UP
- 31. 31©2018 Check Point Software Technologies Ltd. “Best” of Breed Approach…..
- 32. 32©2018 Check Point Software Technologies Ltd. Crazy Statistics: Law No. 4: W/ Innovation Comes Opportunity For Exploitation
- 33. 33©2018 Check Point Software Technologies Ltd. LEGIT: “Coffee_Guest” (Fair to Poor Signal) LEGIT: “Coffeee_Guest” (Full Bars)
- 34. 34©2018 Check Point Software Technologies Ltd.
- 35. 35©2018 Check Point Software Technologies Ltd.
- 36. 36©2018 Check Point Software Technologies Ltd. LAST 18 MONTHS:
- 37. 37©2018 Check Point Software Technologies Ltd. Law No. 3: Humans Trust Even When They Shouldn't
- 38. 38©2018 Check Point Software Technologies Ltd. SHARED Intelligence =
- 39. 39©2018 Check Point Software Technologies Ltd.
- 40. 40©2018 Check Point Software Technologies Ltd.©2018 Check Point Software Technologies Ltd. Don’t be caught unprepared. Uncover potential risks on your enterprise network.
- 41. 41©2018 Check Point Software Technologies Ltd.
- 42. 42©2018 Check Point Software Technologies Ltd. Thank you.
- 43. 43©2018 Check Point Software Technologies Ltd. Thank you. Raffle/FAVOR
- 44. 44©2018 Check Point Software Technologies Ltd. 44©2018 Check Point Software Technologies Ltd. [Internal Use] for Check Point employees Machine Learning CPU-Level Sandboxing Threat Extraction Virtual Firewall Endpoint Detection & Response Human Behavioral Analytics Data Encryption Data Leak Prevention Anti-Bot Flash Detonation URL Filtering Firewall ICS/ SCADA Protection Machine Learning Proxy Network Encryption Anti- Ransomware Zero Phishing Mobile Threat Prevention CPU-Level Sandboxing HTTPS Inspection Intrusion Prevention Anti-Virus DDOS Hypervisor Level Security Application Control
- 45. 45©2018 Check Point Software Technologies Ltd. Time
Notas del editor
- It’s time to look at your organization differently – someone else already is!
- Anyone know who this is? Seth Godin – Creator of Google Marketing, Author of NYT Best Sellers, Bizzillionare – in many of his books – he talks about the importance of definitions in business/business meetings – getting everyone on the same page…..I have adopted that methodology and would like to start there – what is the cloud?
- We can all agree that there are a wide variety of types of cloud computing: private, public, hybrid, community, etc…But are they all secure/safe by default? Does the provider hold responsibility for keeping your data safe? What makes me laugh is when people complain about the cloud when they are utililsing a FREE service…..E-Mail is the biggest one….
- So everyone has a cloud in 2018 – the 800lb. Gorillas in the game most certainly have a large presence: Microsoft, Google, Amazon
- The cloud has become part of our every day lives – there really isn’t a way of getting around it. You can no longer buy a CD for software, it’s delivered to you via the cloud. The 800lb. Gorrila/the mother ship/Microsoft now has included ways to save your work to the cloud as a default location. You can utilize google photos to save space on your i-phone…..for free!
- We can all agree that there are a wide variety of types of cloud computing: private, public, hybrid, community, etc…But are they all secure/safe by default? Does the provider hold responsibility for keeping your data safe? E-Mail is the biggest one….
- We can all agree that there are a wide variety of types of cloud computing: private, public, hybrid, community, etc…But are they all secure/safe by default? Does the provider hold responsibility for keeping your data safe? What makes me laugh is when people complain about the cloud when they are utililsing a FREE service…..E-Mail is the biggest one….
- Jim is a long term employee of 18+ years with the same “company” and performs his job well. Jim is a accounting professional supporting multiple departments and reports to a C-Suite title. On March 22nd, Jim entered work just like any other day- started his day by logging on to his PC, checking e-mail and returning voicemails. Jim was just getting his day started when he noticed his PC acting funny, internet was on and off for a few minutes and then completely locked out with no email or internet or access to his files. His PC was affected with ransomware as was his entire network.
- Let’s address the elephant in the room….Atlanta was the “company” that was hacked. It made national news and unfortunately a number of other cities followed. Savannah and Baltimore just to name a couple.
- Let’s start with the elephant in the room – the city of ATL was recently hacked – Ransomware. Orbits was also hacked with almost a million customer records leaked. This sort of stuff happens every day – it’s just the ones that carry a large recognizable logo that make the headlines – this happens even more often in the Mid-sized market place, but they don’t report it because they aren’t household names.
- Who here has rented a car recently? What is the 1st thing you do…..after signing paperwork? You walk around the car with the rep, check for dents/dings, check gas level, make sure is has 4 tires, etc. They don’t check the engine with you, they don’t check the electronics, the power windows, etc. They give you a car that drives……that’s it, and you’re off.
- What do you travel with? What do you put in your car? Would you leave this in a “bad” part of town with the windows down and the doors unlocked? So why are you leaving your cloud in the bad part of town with doors unlocked and windows down?
- What are you able to put around your car? Lock the doors? Hire someone (MSP – Staff) to watch it? Put a fence around it (Technology?) Spot lights to ensure you can see it at all times (technology?)
- You have the responsibility to protect that car/cloud – it’s in good share when it was given to you – but the provider’s responsibility do in fact end there – they’ve give you the keys, now you have to manage it, protect it, ensure it stays safe…..So how do you do that?
- So, we built a cloud environment from a popular cloud service provider (CSP), deployed a server instance in our new cloud environment, and using all the native tools that were available through the CSP, connected our new “cloud service” to the Internet. In addition, for added assurance, we also deployed a Honeypot in front of our new cloud service just on the off-chance something were to slip past the native controls . . . we connected our service through our Honeypot and sat back and watched what happened . . . And almost immediately we found some “interesting” results . . .
- 149 attacks identified by our HoneyPot Ninety two (92) ssh/telnet attacks One (1) scripting attack Seven (7) attacks targeting TCP/UDP ports Forty nine (49) network based According to Distil Networks: “Bad bots made up 20% of all web traffic and are everywhere, at all times—they don’t take breaks and they don’t sleep. Even though bad bots are on all sites, larger sites were hit the hardest in 2016. Bad bots accounted for 21.83% of large website web traffic, which saw an increase of 36.43% since 2015.” Also, “Data centers were the weapon of choice for bad bots with 60.1% coming from the cloud. Amazon AWS was the top originating ISP for the third year in a row with 16.37% of all bad bot traffic—four times more than the next ISP (OVH SAS).” The challenge – these bot armies are programmed to After 7 days: 3.97 Million ssh/telnet based attempts + malware uploaded to the cloud 826 attack attemps detected by Dionaea 9 attack attempts detected by the elastic pot search engine 98 attempts detected by the web application honeypot glastopf and almost 4900 attacks detected by Honeytrap It‘s clear we have a problem – native controls aren‘t enough . . . How do cloud providers deal with this?
- It is worth noting that these figures do not contain any clean traffic. Since there are no real services behind our honeypot, everything we saw and captured were attempts to compromise our environment. In total, we witnessed: 3.97 Million ssh/telnet based attempts + malware uploaded to the cloud 826 attack attemps detected by Dionaea 9 attack attempts detected by the elastic pot search engine 98 attempts detected by the web application honeypot glastopf and almost 4900 attacks detected by Honeytrap Our test simulated a typical cloud environment, thus this is what customers are likely to see in a similar span of time – especially if they just utilize the native ACL filters available through their cloud provider. We can clearly see that cloud assets are vulnerable to the same types of attacks targeting our premises-based networks, but the key difference is that on-prem we deploy advanced security protections to safeguard our assets; we need to start doing the same thing in the cloud.
- Let’s start with the elephant in the room – the city of ATL was recently hacked – Ransomware. Orbits was also hacked with almost a million customer records leaked. This sort of stuff happens every day – it’s just the ones that carry a large recognizable logo that make the headlines – this happens even more often in the Mid-sized market place, but they don’t report it because they aren’t household names.
- We are in talks with companies that take their security so serious they are adding layers of protection that are not just technology – they include their attorney to document conversations – having a legal layer of protection. Lots of firms are now implementing cyber-insurance as an added layer of protection (re-active), but another layer.