1. The next frontier in Endpoint security
Dan Larson, Crowdstrike

2. $150 Cost per stolen record
2016
22% Rise in breaches
146 Day Average dwell time
$150 Cost per stolen record
2015 CROWDSTRIKE, INC. ALL RIGHTS RESERVED.

3. 77%
77 percent of U.S. businesses admitted that they have suffered between one and five separate incidents of data loss, leakage or exposure in the past 12 months
2015 CROWDSTRIKE, INC. ALL RIGHTS RESERVED.

4. How are the bad guys getting in?
2015 CROWDSTRIKE, INC. ALL RIGHTS RESERVED.

5. Abuse of weak domain user passwords
Broadcast name resolution poisoning (like WPAD)
Local admin password attacks (pass-the-hash)
Attacks on cleartext passwords in memory (Mimikatz)
Insufficient network segmentation
2015 CROWDSTRIKE, INC. ALL RIGHTS RESERVED.

6. Making matters worse
2015 CROWDSTRIKE, INC. ALL RIGHTS RESERVED.

7. Zero days are A last resort
2015 CROWDSTRIKE, INC. ALL RIGHTS RESERVED.

8. How do we stop the bad guys?
2015 CROWDSTRIKE, INC. ALL RIGHTS RESERVED.

9. Machine Learning Effective against: New, modified or packed malware
Primary benefit: Ani-malware efficacy and system performance
Caution
Watch out for “learning” period
Malware is used in less than 50% of attacks
Blind spots: The rest of the kill chain, and advanced infection vectors like web shells or ”file-less” malware
Machine Learning
2015 CROWDSTRIKE, INC. ALL RIGHTS RESERVED.

10. Behavioral Analytics Effective against
Web shells and other advanced infections (e.g. stolen passwords & abuse of legit tools)
Ransomware
Lateral movement
Persistence
Data access and exfil
Primary benefit: Coverage for malware-free attacks and polymorphic malware
Caution: Detecting is easier than preventing
Blind spots: Anything happening pre-execution
Behavioral Analytics
2015 CROWDSTRIKE, INC. ALL RIGHTS RESERVED.

11. Effective against: Exploits - Hugely prevalent exploit kits
Primary benefit: System hardening
Caution: Learning mode, FPs, extracting value
Blind spots: Insider threat, stolen credentials, abuse of legitimate tools
Exploit Mitigation
2015 CROWDSTRIKE, INC. ALL RIGHTS RESERVED.

12. Sandboxing & Isolation
Effective against: Exploits - Hugely prevalent exploit kits
Primary benefit: Impact reduction
Caution: Now a part of Windows, user impact
Blind spots: Insider threat, stolen credentials, abuse of legitimate tools
Sandboxing & Isolation
2015 CROWDSTRIKE, INC. ALL RIGHTS RESERVED.

13. Effective against: Advanced threats, zero days, APT activity, insider threat, abuse of legit tools
Primary benefit: Visibility
Caution
Who does the work?
How “smart” is it?
Does it scale?
Do you really want forensics?
Blind spots: Prevention
Detection & Response
2015 CROWDSTRIKE, INC. ALL RIGHTS RESERVED.

14. Effective against: Advanced threats, zero days, APT activity, insider threat, abuse of legit tools
Primary benefit: Visibility, tailored detections
Caution
Do you have the talent for this?
Hunting vs. MSSP
Data availability and breadth
Blind spots: Prevention
Threat Hunting
2015 CROWDSTRIKE, INC. ALL RIGHTS RESERVED.

15. Closing thoughts Think about the entire kill chain
Penetration test new products
2015 CROWDSTRIKE, INC. ALL RIGHTS RESERVED.