Part 2: How to Detect Insider...

Part 2: How to Detect Insider Threats

Amichai Shulman Chief Technology Officer

Imperva

Amichai Shulman – CTO, Imperva

• Speaker at Industry Events – RSA, Appsec, Info Security UK, Black Hat

• Lecturer on information security – Technion - Israel Institute of Technology

• Former security consultant to banks and financial services firms • Leads the Imperva Defense Center • Discovered over 20 commercial application vulnerabilities

– Credited by Oracle, MSSQL, IBM and Others

Amichai Shulman one of InfoWorld’s “Top 25 CTOs”

Direct EXTERNAL Attacks

Persistent INTERNAL

Attacks

Attacks are inevitable

Users get compromised

Data is the target

4 Crowd Research Partners, Insider Threat Spotlight Report, 2015

Why Detection is Difficult: Information Overload Hiding Abuse in Plain Sight

More legitimate data access Volumes of disparate logs Security alert overload

Layered Detection Strategy

Data access and theft

Lateral movement

Initial compromise Endpoints and BYOD

Internal Network

Attack Lifecycle – Data is the Target

Crowd Research Partners, Insider Threat Spotlight Report, 2015

Layered Detection Strategy

Assuming that a compromise is inevitable, advanced technologies should be focused on finding the

attack past the initial foothold.

1. Deception

2. Behavior Analytics

1: Deception

What is Deception Technology?

• Deception technologies are defined by the use of deceit and/or feints designed to thwart or throw off an attacker's cognitive processes, disrupt an attacker's automation tools, delay an attacker's activities or disrupt breach progression.

Source: Gartner, Emerging Technology Analysis: Deception Techniques and Technologies Create Security Technology Business Opportunities, 16 July, 2015

Why Use Deception?

• Compromise is inevitable – No perimeter: BYOD, cloud apps, VPN – Legitimate apps (TeamViewer, DropBox) – Zero days – Social engineering

Why Use Deception?

• Find data breach within compromises – Compromises happen all the time… few of them may turn into a breach! – Response teams need to prioritize – 100 alerts << 1 alert

Why Use Deception?

• Find data breach within compromises – Compromises happen all the time… few of them may turn into a breach! – Response teams need to prioritize – 100 alerts << 1 alert

• Detect a breach ASAP – Reconnaissance and lateral movement

Deception Tokens

• Tokens deployed across the enterprise • Point the attacker towards a trap

– Internal web app, file server, database, etc. – Local / Domain Account – Passwords, Cookies, Authentication Tokens

Deception Tokens

• Detection = harvest + used token – Deliberate attempt at the data center / gain more privileges

Deception Tokens

• Detection = harvest + used token – Deliberate attempt at the data center / gain more privileges

Patent: Compromised Insider Honey Pots Using Reverse Honey Tokens

Compromised Users: Deceiving Attackers with Deception Tokens

• Trojan penetrates endpoint via phishing

• Tokens used: planted Windows Vault and Internet Explorer credentials

• Determine the source and scope of the attack without tipping off the bad actor

2: Behavior Analytics

How do I respond

QUICKLY if not?

Exactly

WHO Is accessing my data?

Truly Detecting and Containing Breaches Requires Addressing All

OK? Is the access

BLOCK / QUARANTINE

Detecting and Containing Breaches

LEARN AND DETECT MONITOR MONITOR

CounterBreach User Interface

BehaviorAnalytics

machine learning

LEARN AND DETECT BLOCK / QUARANTINE

MONITOR

Visibility

Contain and

Investigate

Deception Tokens

Monitor access to databases,

file servers and cloud apps

Behavioral Baseline: Good Data Access vs. Bad Data Access

PCI Database

Who is connecting to the database?

How do they connect to the database?

Do their peers access data in the same way?

When do they usually work?

What data are they accessing?

How much data do they query?

Learning Data Access Patterns

• Leverage machine learning to understand the environment

• Leverage machine learning to understand the environment 1. Identify user and connection types

Service Account

Interactive User (DBA)

Individual DB Account

Application

• Leverage machine learning to understand the environment 1. Identify user and connection types 2. Understand data

• Typical purpose of data

Sensitive Application Data

Metadata

Service Account

Application

• Leverage machine learning to understand the environment 1. Identify user and connection types 2. Understand data

• Typical purpose of data 3. Understand data access patterns

• Amount of data • Comparison to peer groups • Typical working hours

Metadata

Service Account

Application

1 – Suspicious Application Table Access

• Identify compromised, careless and malicious users – Application Table Access

Detect

Metadata

Service Account

DB Account

Application

1 – Suspicious Application Table Access

• Identify compromised, careless and malicious users – Application Table Access

Detect

Metadata

Service Account

DB Account

Application

2 – Service Account Abuse

• Identify compromised, careless and malicious users – Application Table Access – Service Account Abuse

Detect

Metadata

Service Account

Interactive User

3 – Excessive Data Access

• Identify compromised, careless and malicious users – Application Table Access – Service Account Abuse – Unusual Data Retrieval

Detect

Metadata

Customer Support (Peer Group)

Typical: Maintenance on 5

records

3 – Excessive Data Access

• Identify compromised, careless and malicious users – Application Table Access – Service Account Abuse – Unusual Data Retrieval

Detect

Metadata

DB Account

Support Analyst

Customer Support (Peer Group)

Typical: Maintenance on 5

records

Anomaly: Retrieves 1,000 records out of working hours

Confidential 33

The Power of a Layered Approach

5 Minute Break

Part 2: How to Detect Insider...

Documents

Detect to Track and Track to Detect - CVF Open Accessopenaccess.thecvf.com/content_ICCV_2017/papers/Feichten... · 2017-10-20 · Detect to Track and Track to Detect Christoph Feichtenhofer

Detect to Track and Track to Detect - University of Oxfordvgg/publications/2017/Feichtenhofer17/feichtenhofer17.pdf · Detect to Track and Track to Detect Christoph Feichtenhofer

ISC2 CISSP Exam Outline English - April 2021

Router Hardening Nancy Grover, CISSP ISC2/ISSA Security Conference November 2004

ISC2 Cybersecurity Workforce Study

ISC2 Code of Ethics - 1 File Download

ISC2 Series Pages 2-21 - Flowservewater.flowserve.com/files/Files/Literature/ProductLiterature/Seals/... · ISC2 Series Innovative Standard ... ISC2-XP - Single pusher seal with a

Inspect & Detect

Detect to Track and Track to Detect · 2017. 10. 20. · Detect to Track and Track to Detect Christoph Feichtenhofer ∗ Graz University of Technology feichtenhofer@tugraz.at Axel

Software Development: The Next Security Frontier Glenn Johnson Certification Consultant (ISC)2 Americas gjohnson@isc2.org gjohnson@isc2.org James E. Molini,

ISC2 Series Pages 2-21 - Flowserve Corporation...Pages 2-21 Experience In Motion ... -Original Instruction-ISC2 Series Innovative Standard Cartridge seal designed for general purpose

Alchemist XF Understanding Cadence - SAM · PDF fileAlchemist XF Understanding Cadence Cadence, Detect Film Detect . Detect Detect Detect

CPE Handbook - isc2

Edge Detect

ISC2 CPE Guidelines

ISC2 Survey

Course Outline · 2020-02-28 · 1. Course Objective Prepare for the ISC2 CISSP certification exam with the ISC2 CISSP Study Guide 8th edition course and lab. The lab can be mapped

Isc2 secure sdlc owasp achieving compliance v1.0 2012 05-04

Infosecurity Professional Magazine - isc2.org

ISC2 CISSP Practice Test Questions-CISSP Exam Dumps | Exam4Help.com