Embed Size (px)
Citation preview
Copyright © 2014 Oracle and/or its affiliates. All rights reserved.
Paul Laurent, J.D., M.S., CISSP, CISA Director of Cybersecurity Strategy
Public 1
“Cyber Certainty”
Copyright © 2014 Oracle and/or its affiliates. All rights reserved.
An Introduction:
Copyright © 2014 Oracle and/or its affiliates. All rights reserved.
Conversations with:
- Business leadership - Security - Audit - Legal - Law Enforcement - Opposing Counsel
(Ranked in descending order of “fun”)
Copyright © 2014 Oracle and/or its affiliates. All rights reserved.
Pregame Routine:
Copyright © 2014 Oracle and/or its affiliates. All rights reserved.
APTs
5
Copyright © 2014 Oracle and/or its affiliates. All rights reserved.
Meet PLA Unit 61398…
6
- “Quality Intrusions – Since 2006”
- >1000 Servers
- >2000 Employees
- 3 “personas”
Copyright © 2014 Oracle and/or its affiliates. All rights reserved.
Modus Operandi
7
- Spearphish - Recon
- Persistent - Privileges - Auditing
- Package up and remove EVERYTHING
Copyright © 2014 Oracle and/or its affiliates. All rights reserved.
Even If: Lone Wolves & Insiders
• Immense fallout from leaks • 3x as likely to target Public
Sector’s “Crown Jewel” Data Sets
• Curiosity, Ideology, Fame, Challenge, Advantage
Copyright © 2014 Oracle and/or its affiliates. All rights reserved. 9
- USPS
- Large scale health care intrusions
- USIS
- OPM
Threat Vectors: The Expanding Possible*
Copyright © 2014 Oracle and/or its affiliates. All rights reserved.
Threat Vectors: Can’t Make These Up…
Copyright © 2014 Oracle and/or its affiliates. All rights reserved.
Threat Vectors: File Under??
Copyright © 2014 Oracle and/or its affiliates. All rights reserved.
Copyright © 2014 Oracle and/or its affiliates. All rights reserved.
Hacktivists Before “The Interview” & Incentives
Copyright © 2014 Oracle and/or its affiliates. All rights reserved.
The Day I Stopped Doing Vector Analysis…
Copyright © 2014 Oracle and/or its affiliates. All rights reserved.
What’s More Preposterous?
Copyright © 2014 Oracle and/or its affiliates. All rights reserved.
Copyright © 2014 Oracle and/or its affiliates. All rights reserved.
Copyright © 2014 Oracle and/or its affiliates. All rights reserved.
What’s typically missing?
18
- Clear understanding of the business objectives & priorities (risk)
- Risk Optics - The most granular unit of risk?
- “RBAC” - Impact on:
- Policy - Process - Enterprise Architecture
Copyright © 2014 Oracle and/or its affiliates. All rights reserved.
Involving Business
Copyright © 2014 Oracle and/or its affiliates. All rights reserved.
FCC v. Pacifica Foundation
Copyright © 2014 Oracle and/or its affiliates. All rights reserved.
The Security/Privacy Ratio
Copyright © 2014 Oracle and/or its affiliates. All rights reserved.
Having a Plan…
Copyright © 2014 Oracle and/or its affiliates. All rights reserved.
Key Takeaway 1: Even with the best statistical
chance…
Copyright © 2014 Oracle and/or its affiliates. All rights reserved.
Key Takeaway 2: “Risk” has multiple meanings
Copyright © 2014 Oracle and/or its affiliates. All rights reserved.
Key Takeaway 3: Speak the Same Language (Use Wheels)
Copyright © 2014 Oracle and/or its affiliates. All rights reserved.
Sample Objectives • Connect data to business risk • Common taxonomy for data
– Relation to business impact, not overly complex – Seek for commonality in interoperability, participation in programs, & grant
applications
• Methodology – Common risk/data taxonomy Ranks risk to confidentiality, integrity, & availability into
3 categorizations – Controls based on risk/impact
Copyright © 2014 Oracle and/or its affiliates. All rights reserved.
A little help: Database Security Methodology Overview
Copyright © 2014 Oracle and/or its affiliates. All rights reserved.
Recommendations 1 Protect Sensitive Data
2 Enhance Auditing and Alerting of Database Activity
3 Encrypt Data at Rest
4 Password Controls
5 Separation of Duties/Control Authorized Access
6 Update Patching
7 Revoke Privileges on Sensitive Packages From “PUBLIC”
8 Server Security – file privileges
9 SQL Injection Prevention
10 Minor configuration issues
Mapped to a strategy: e.g. Value/Effort Map
Oracle Confidential - Restricted
2 3
6 7
8 10
1
9
28
5 4
Copyright © 2014 Oracle and/or its affiliates. All rights reserved.
Granular specifics & configuration detail
Copyright © 2014 Oracle and/or its affiliates. All rights reserved.
Questions
| Oracle Confidential – Highly Restricted 30
