• Home

  • Technology

  • When and why encryption doesn’t protect your data against malware
9
9/9/2016 1 Sponsored by When and Why Encryption Doesn’t Protect Your Data Against Malware © 2016 Monterey Technology Group Inc. Thanks to Made possible by

When and why encryption doesn’t protect your data against malware

Embed Size (px)

Citation preview

Page 1: When and why encryption doesn’t protect your data against malware

9/9/2016

1

Sponsored by

When and Why Encryption Doesn’t Protect Your Data Against Malware

© 2016 Monterey Technology Group Inc.

Thanks to

Made possible by

Page 2: When and why encryption doesn’t protect your data against malware

9/9/2016

2

Preview of key points

Encryption technologies Which risks designed to control

Which not

Limiting the risk of malware and APT attackers

Comprehensive data retention and erasure

Demo of encryption

EFS

BitLocker

Access my files

Access someone else’s files

Page 3: When and why encryption doesn’t protect your data against malware

9/9/2016

3

Limiting the risk of malware and APT attackers

Yes - Endpoint security

Probably not - DLP

Yes - Comprehensive data retention and erasure

Comprehensive data retention and erasure

1. Harvesting “deleted” files

2. Left-over copies of files no longer needed such extra data

3. Old files beyond data retention policy

4. Temporary files in user’s own profile

5. Temporary, or left over, files after a privileged user logged off a PC

6. User data found on and recovered from free disc space of a drive

7. (Unencrypted) Data copied over to a removable media unit

8. Classified data saved in open storage by mistake

9. Application data left from user or business processes

10. Sensitive data required to travel internationally (where decryption is forced)

Page 4: When and why encryption doesn’t protect your data against malware

9/9/2016

4

Harvesting “deleted” files

User data found on and recovered from free disc space of a drive

Malware does this Example: Regin

Left-over copies of files no longer needed

Backup files created by apps

Dev/test/QA environments Copies of production data

Often linger after test is done

Page 5: When and why encryption doesn’t protect your data against malware

9/9/2016

5

Old files kept beyond data retention policy

Analyze File age

File type

Department

Keywords

Data Retention

Page 6: When and why encryption doesn’t protect your data against malware

9/9/2016

6

Temporary files in user’s own profile

From Microsoft Word, etc

Internet browsers temp files Not just Internet

Think corporate content from web applications

Temporary, or left over, files after a privileged user logged off a PC

Scenario: Privileged user away from desk

Urgent problem to solve

Logs onto available workstation

Views some privileged information like Excel worksheet of server passwords

Page 7: When and why encryption doesn’t protect your data against malware

9/9/2016

7

(Unencrypted) Data copied over to a removable media unit

Does it ever get erased?

Classified data saved in open storage by mistake

Happens all the time

Just deleting it isn’t enough

Power user should be able to in an erase it

Page 8: When and why encryption doesn’t protect your data against malware

9/9/2016

8

Application data left from user or business processes

Extracts

Downloads

Imports/exports

Intermediate steps

Other repetitive processes

Sensitive data required to travel internationally (where decryption is forced)

Crossing into certain countries can be forced by entry customs to unlock encryption

In some industry – cannot cross borders with certain dataj Deletion doesn’t cut it

Page 9: When and why encryption doesn’t protect your data against malware

9/9/2016

9

Bottom line

Prevent malware

Track user access and horizontal movement

Don’t leave a treasure trove of stale data laying around

Enforce data retention and erasure policies At every level

Every endpoint

Every user Awareness training

Facilitate compliance with available and easy-to-user tools

Automate as much as possible

Time is of the essence Time = risk

© 2016 Monterey Technology Group Inc.

Additional Data Erasure Resources

(Whitepaper) Integrating Secure Data Erasure With Active Directory

http://info.blancco.com/integrating-file-erasure-with-active-directory.html

(Guide) 6 Rules to Follow When Erasing Files Through Active Directory

http://download.blancco.com/download/6-rules-to-follow-when-erasing-files-through-active-directory.pdf

(Free 90 Day Subscription) Blancco File Deployment Through Microsoft Active Directory with Technical Support

http://info.blancco.com/pocfile


MANDIANT M-Trends: The Advanced Persistent Threat»»The malware uses encryption and obfuscation ... »»Some other client software exploit, like an Adobe Reader exploit. ... A forensic

MANDIANT M-Trends: The Advanced Persistent Threat»»The malware uses encryption and obfuscation ... »»Some other client software exploit, like an Adobe Reader exploit. ... A forensic

Documents
Here encryption, there encryption, simple encryption ...€¦ · MQ Technical Conference v2.0.1.7 Here encryption, there encryption, simple encryption everywhere Roger Lacroix

Here encryption, there encryption, simple encryption ...€¦ · MQ Technical Conference v2.0.1.7 Here encryption, there encryption, simple encryption everywhere Roger Lacroix

Documents
Malware Slums: Measurement and Analysis of Malware on ...homepage.cs.uiowa.edu/~mshafiq/files/malware... · Malware Slums: Measurement and Analysis of Malware on Traffic Exchanges

Malware Slums: Measurement and Analysis of Malware on ...homepage.cs.uiowa.edu/~mshafiq/files/malware... · Malware Slums: Measurement and Analysis of Malware on Traffic Exchanges

Documents
Chapter 8 Malware - FTMS · – Boot virus – Logic Bomb virus – Directory virus – Resident virus. CSCA0101 Computing Basics 8 Malware Types of Malware ... Malware Types of Malware

Chapter 8 Malware - FTMS · – Boot virus – Logic Bomb virus – Directory virus – Resident virus. CSCA0101 Computing Basics 8 Malware Types of Malware ... Malware Types of Malware

Documents
Malware and anti-malware (fun with Trojans) - Z. …z.cliffe.schreuders.org/edu/FS/Malware and anti-malware... · 2014-04-02 · Malware and anti-malware (fun with Trojans) ... with

Malware and anti-malware (fun with Trojans) - Z. …z.cliffe.schreuders.org/edu/FS/Malware and anti-malware... · 2014-04-02 · Malware and anti-malware (fun with Trojans) ... with

Documents
christopher.howett@microsoft.com … · 2019-08-27 · Smart Screen Anti Malware Email Security Data Loss Prevention Device Control Disk Encryption File Encryption Privilege Management

[email protected] … · 2019-08-27 · Smart Screen Anti Malware Email Security Data Loss Prevention Device Control Disk Encryption File Encryption Privilege Management

Documents
Ch 12: Covert Malware Launching - samsclass.info · Practical Malware Analysis Ch 12: Covert Malware Launching Last revised: 4-10-17. Hiding Malware • Malware used to be visible

Ch 12: Covert Malware Launching - samsclass.info · Practical Malware Analysis Ch 12: Covert Malware Launching Last revised: 4-10-17. Hiding Malware • Malware used to be visible

Documents
Reversing malware analysis trainingpart9 advanced malware analysis

Reversing malware analysis trainingpart9 advanced malware analysis

Technology
Android Malware Exposed-Evolution of Android Malware

Android Malware Exposed-Evolution of Android Malware

Documents
Lecture # 34 Privacy and Security. Passwords Spam Scams Viruses and Worms (Malware) Intellectual Property and Copyright Cookies Encryption Back-Ups

Lecture # 34 Privacy and Security. Passwords Spam Scams Viruses and Worms (Malware) Intellectual Property and Copyright Cookies Encryption Back-Ups

Documents
Mobile Security · 2020. 9. 21. · Introduction. Mobile Threats Corruption, modification or encryption of stored data Malware infection Misuse of data. Data loss due to mobile theft,

Mobile Security · 2020. 9. 21. · Introduction. Mobile Threats Corruption, modification or encryption of stored data Malware infection Misuse of data. Data loss due to mobile theft,

Documents
Computer Virology and Mobile Malware Detection · 2019-03-14 · Outline •Introduction •Computer Virology • Malware taxonomy • Encrypted malware •Malware Detection •Mobile

Computer Virology and Mobile Malware Detection · 2019-03-14 · Outline •Introduction •Computer Virology • Malware taxonomy • Encrypted malware •Malware Detection •Mobile

Documents
Malware Fails Best Bugs in Malware Felix Leder [Malware ... · 1 Malware Fails Best Bugs in Malware Felix Leder [Malware Detection Team] Felix.Leder@norman.com 5. desember 2011 malware

Malware Fails Best Bugs in Malware Felix Leder [Malware ... · 1 Malware Fails Best Bugs in Malware Felix Leder [Malware Detection Team] [email protected] 5. desember 2011 malware

Documents
Functional Encryption & Property Preserving Encryption

Functional Encryption & Property Preserving Encryption

Documents
Intrusion Detection and Malware Analysis - Malware collection

Intrusion Detection and Malware Analysis - Malware collection

Documents
Simple and powerful encryption - ESET Antivirus, Internet ... · customers and support, ESET should be on the short list for consideration in enterprise RFPs for anti-malware solutions.”

Simple and powerful encryption - ESET Antivirus, Internet ... · customers and support, ESET should be on the short list for consideration in enterprise RFPs for anti-malware solutions.”

Documents
Malware Analysis Analysis.pdf · Definisi Malware Analysis • What is a malware? • Malware (malicious software) ... Malware Sinkronisasi Token • Pelaku: Zeus Banking Trojan •

Malware Analysis Analysis.pdf · Definisi Malware Analysis • What is a malware? • Malware (malicious software) ... Malware Sinkronisasi Token • Pelaku: Zeus Banking Trojan •

Documents
Practical Malware Analysis: Ch 11: Malware Behavior

Practical Malware Analysis: Ch 11: Malware Behavior

Education
Cryptography Gerard Klonarides. What is cryptography? Symmetric Encryption Symmetric Encryption Asymmetric Encryption Asymmetric Encryption Other cryptography

Cryptography Gerard Klonarides. What is cryptography? Symmetric Encryption Symmetric Encryption Asymmetric Encryption Asymmetric Encryption Other cryptography

Documents
Malware & Anti-Malware

Malware & Anti-Malware

Engineering
Chapter 2 – Classical Encryption Techniques Symmetric encryption Secret key encryption Shared key encryption

Chapter 2 – Classical Encryption Techniques Symmetric encryption Secret key encryption Shared key encryption

Documents
Introduction to Mobile Malware. Outline ➢ Introduction ➢ Types of Malware ➢ Malware examples ➢ How Malware Spreads ➢ Prevention ➢ AndroRAT Hands-on Lab

Introduction to Mobile Malware. Outline ➢ Introduction ➢ Types of Malware ➢ Malware examples ➢ How Malware Spreads ➢ Prevention ➢ AndroRAT Hands-on Lab

Documents
AVPASS: Automatically Bypassing Android Malware Detection ...avpass-slides.pdf · 9 Java reflection transformation N/A 10 Resource encryption (xml and image) Appearance. APK Obfuscation

AVPASS: Automatically Bypassing Android Malware Detection ...avpass-slides.pdf · 9 Java reflection transformation N/A 10 Resource encryption (xml and image) Appearance. APK Obfuscation

Documents
Rootkits vs. Stealth by Design Malware - Black Hat · Malware doesn’t need to modify code sections (we can always verify code section integrity) The real problem is malware which

Rootkits vs. Stealth by Design Malware - Black Hat · Malware doesn’t need to modify code sections (we can always verify code section integrity) The real problem is malware which

Documents
White Paper The Ongoing Malware Threat: How …...White Paper: The Ongoing Malware Threat incident,5 a figure that doesn’t take into account the fear and loss of trust that usually

White Paper The Ongoing Malware Threat: How …...White Paper: The Ongoing Malware Threat incident,5 a figure that doesn’t take into account the fear and loss of trust that usually

Documents
Memory Forensics: Defeating Disk Encryption, Skilled Attackers, and Advanced Malware

Memory Forensics: Defeating Disk Encryption, Skilled Attackers, and Advanced Malware

Technology
7/26/2013 OUTLOOK 2007 & 2010 EMAIL ENCRYPTION REQUIRED FOR OUTGOING EMAIL WITH SENSITIVE CUSTOMER CONTENT (Encryption Doesn’t Work For Email Within the

7/26/2013 OUTLOOK 2007 & 2010 EMAIL ENCRYPTION REQUIRED FOR OUTGOING EMAIL WITH SENSITIVE CUSTOMER CONTENT (Encryption Doesn’t Work For Email Within the

Documents
Mobile Malware Network View - Black Hat · Mobile Malware Network View ... ... Windows Malware impacts mobile

Mobile Malware Network View - Black Hat · Mobile Malware Network View ... ... Windows Malware impacts mobile

Documents
ecriyAwarenee - ComplianceKIT€¦ · malware program so my computer doesn’t get infected. Behavior Change >> I will install anti-malware on all my devices—not just computers,

ecriyAwarenee - ComplianceKIT€¦ · malware program so my computer doesn’t get infected. Behavior Change >> I will install anti-malware on all my devices—not just computers,

Documents
Metamorphic Malware 1 Metamorphic Malware Research

Metamorphic Malware 1 Metamorphic Malware Research

Documents