1. Lessons From The Defensive Security Podcast
@maliciouslink

2. I’m Jerry Bell Work @ IBM – I speak for myself only
DefensiveSecuirty.org
@maliciouslink

3. “
Those who cannot remember the past are condemned to repeat it. - George Santayana

5. I study how data breaches happen and talk about them on a podcast

6. Many opportunities to learn

7. As defenders, we have limited budget, limited time

8. As defenders, we have limited budget, limited time
We must efficiently prioritize

9. There are many good industry reports that help explain breaches

10. Most reports segment breaches by attack type or motives of the adversary

11. Reports are helpful… But they do not explain what to fix.

12. What I’ve learned

13. Our people are the key to security

14. Our people are the key to security
Let me explain…

15. Security researchers have grown adept at manipulating media coverage of vulnerabilities they found

16. The concept of “least privilege” is not well understood or implemented

17. Example: NotPetya

18. Supply chain is a significant emerging threat

19. Example: NotPetya, Target

20. IT architectures and software are more a form of individual artistic expression than principled engineering

21. “
Hackers only have to be right once… Defenders have to be right every time.

22. Attacks shift away from what no longer works to what does work

24. Attack techniques and tools are getting more complicated

25. Attack techniques and tools are getting more complicated
But opportunistic attacks still work very well

26. The industry endlessly debates end-user security training

27. The industry endlessly debates end-user security training
But rarely about training the people designing our IT systems

28. The debate about end user training is a red herring

29. Business leaders have little idea how much risk they are accepting

30. Our IT tools are being used against us

31. Cloud and automation create dramatic opportunities to mitigate risk… and also creates new risks

32. Indicators that a breach was underway are usually obvious… But only during forensic analysis

33. The entry point in nearly all breaches seems obvious… After the breach happened

34. Organizations are judged on their handling of a breach… Possibly more than having the breach

35. Organizations will have difficulty meeting breach reporting timeframes of new regulations

36. Security is a people problem… …and the problem start with IT and Security staff.

37. THANK YOU!
@maliciouslink