So this talk is on werewolf's, silver bullets,
vampires, those sort of things. My name is Wolf Goerlich. I a, two things about me. I
recently joined DUO and by recently I mean like, Monday. So yea DUO! It was really
good. It's like hey, I got a new job and then awesome, welcome aboard. Yeah it's
great, like what are you gonna do? I'm like well on Thursday and Friday I'm
going to be out of town. So awesome to be at CypherCon.
Second thing is, second thing is, I drank holy water. Now, you may hear that, you may
go mmm. When he dies he's gonna have a hard time. But I would say, when I die you
all are really safe, here's why. First of all, when you drink holy water, you really
shouldn't do this. But if you do it, a couple key things need to be in place.
One, you need to be out of coffee, that's important. No coming to uh, come to light
later why. Two, you need to be not only out of coffee but it needs to be dark. And it
helps if you store coffee or in holy water, in separate places but close to
the shelves so that when it's 3:00 in the morning and you're looking for caffeine,
you can mix these things up. Now, if I stole the soundtrack later like that scratching sound, like
you know when the record skip, how did get himself into this thing? So today I was, I was
with my boss and they took us to this like monastery, I think it was close, it was like
Holy Hill. Holy Hill, it wast Holy Hill. And I was
always telling my wife I want holy water. You don't need holy water.
You don't need holy water. So you don't need holy water.
So you never know when there's gonna be vampires. She's like you're an idiot. But we ended up
there. And we're walking and walking, we found the place with holy water. And you can have some.
So I wasn't like stealing from the church or anything. So
I'm not gonna go to hell yet. But we only had anything that the captors would
have like a monster. I love energy drinks. I'm happy about
this energy drink bottles and I did and it was great. And fast-forward like six months,
I'm out of coffee, it's 3:00 in the morning, I'm trying to get work done and
runs around, there's some energy bottles up there. Why don't they have labels? It
doesn't matter why they don't have labels. Since I'm drinking it, I was like halfway through I
remembered and my wife told me I was an idiot.
And then I had holy water (in agony noise). So this is bad, this is really bad. But the good
thing is, the good thing is assuming that my soul is not lost. If there is a
vampire attack here at CypherCon, I've got all your backs. I will go to the door,
I will hold them off, you guys run, we've got this people. Holy water's great for
vampires right? Yes? So we're good, we're protected. The problem with cybersecurity
is, you're like I got this thing and it's solved the problem. And now we go
celebrate and hopefully with coffee or something stronger than coffee. And the
next thing you know you find out there's like a bazillion other threats that, that
thing doesn't help protect against. And you're like, But I've got the thing. And you're like, so what bro? So what?
So this talk is about encryption. This talk is about the thing, the holy water. The
Silver Bullet that saves everything and how to use it and where to apply it and
what to do with it and where it works and where it doesn't you know it all
starts with the traditional cybersecurity stuff we need to identify
our assets except for nobody knows what they have they don't necessarily have a
CMDB and if you caught like didn't catch Kristen Merkel's talk I'm like I can
push a button and grunted an assent it is true people push buttons in the live
data centers I worked on cloud security programs and with great you could push a
button watch this or what assets do you have just go looking comes whatever
there's what we have not an asset management program people no problem
okay so maybe we know what our assets are we can then assess the threats
because we all get great threat intelligence don't we it's like clock
against this IP address there is matt baer who's coming out of Russia
attacking us okay that doesn't help even but we assess the threats sort of maybe
because kind of we know what that's coming out of some you don't and then
it's simple from there just protecting prepped it and that's really the end of
the talk there you guys can go home you can grab lunch everything something and
at least sound simple it always sound somewhat was never so Ebola and the
problem is - is that encryption is one of those things
that people talk about and I think they hand and think they're cool everything
everything's good so I sit down with the seats on my page see so what do you have
for encryption like we are protecting other things I'm like that is amazing
Larry yes we've got HTTPS oh we got BitLocker
oh my go buddy we need to have a talk you can't really put your arm around
Omega though your people are telling you're protecting you're not protected
that easy yes it's fantastic it protects all the attacker traffic break through
your back to your website awesome good job and we know encryption doesn't work
right I mean did you make anyone look at information is beautiful I look at the
great graphs that they have for breach the other guests haven't you should I'm
not gonna show I don't have it what I recently found out was that they'd I
could actually redo the whole website and the graphic software because there's
so many breaches of breaking their app like that is fantastic
we are breached so often we are breaking the cool brass to tell us how awful
breach but here's my version of that slide which is how many records have
been stolen from systems that have encryption pretty much everybody right
and again as you can see it's a little bit out of date I don't have like anthem
or an early 2017 from a team Facebook the hotel chains everyone else we almost
happening all the time the problem is the encryptions misplaced a
misconfigured it's pretty much worth us right we think we're safe or not and if
you're a senior person I guess C so our CI or whatnot you think hey bro
everything's cool if your junior person you're like oh you think he's way not
cool but don't tell them that because I'm not give us more work and then if
you're the developer you're like hey you need to work while your databases weaker
get arrested you like are you because do look anthem have there be innovations
encrypted at rest and does anyone really steal hard drives
we don't have a data center right so it's a lot of different debates about
where your future a felon where should be a what should happen and worse when
the kitchen breaks you get really weird things like this famous quote from
Shakespeare and mrs. Ella Eyre has occurred and a secure connection the
server cannot be needed it was a man ahead of his time folks
he really was but this is one of those things that happens when the encryption
goes bad then the developers look at you can go see I told you we should not
refer to that and a higher-ups go you know we will never ever use encryption
product acts ever again if we have gemalto this would not be a problem
that's picking Jamal to your great product
dude listen we can get my point whatever it is if it breaks that product seems
mud for the next foreseeable future and then it can get even worse if you got
like disk encryption and everyone loses their hard drives like what happened
recently when there's the Microsoft Update no one get it locker anymore so
these can be fine thanks again bro finally go she goes wrong so those are
some of the things in my mind I mean other thing that's on my mind is
recently I've been like absolutely obsessed by recent me about a year year
having two years now absolutely obsessed with this concept of going back to
drinking holy water for just a minute you can look at it as a great security
controller it is it is it goes wrong by me drink up rejected from a person but
the good thing is you can look at this is a great life story of how things go
wrong and how to decompress and decompose
errors and failure modes right whenever we get hacked yeah decompose what the
organization was doing or trying to protect and what the criminals trying to
do or trying to prevent right you've got to look at the combination of those two
because the motivations the situations the environments are oftentimes
completely different so okay let their protection prevents and when it
oftentimes looks at is like we're playing the same game with two different
boards you got here is our protection is great protection we've got all the right
pieces places but then you switch the board
around you look at from the attacker point of view you've got the same piece
in the same places but it's a completely different scenario there's different
gaps just different holes there's different motivations that the criminals
are using the following and what that means is we end up playing two games
simultaneously right me to protect organization in its ability to do
whatever it's doing run stuff do health care etc or preventing the crime and
what the criminals are trying to do and all the time trying to stick encryption
in the right spot where it makes sense this is not an easy problem even if you
just look at it from technical perspective it's not an easy problem so
ultimately we did encryption to do both of those things right protect the
organization's ability to machines mission and active intersection where
the organization generates financial value or the criminals are financially
motivated to attack this is the Rhino problem
so just guys see in Paris a couple years ago that all right not sort of got
killed the courts horn you want to see this those in the news I was very
fascinated by that because I'm like why would you do that hey I want to go to
Paris no in the European purse yeah no okay you have like one of those I was
little I was so like I want to be that guy right doesn't want to be the pair so
I won't eat the good food won't get the good wine I wanna see the Eiffel Tower
it's romantic spider bring my wife she won't call me an idiot of promise okay
so maybe I've got a good maybe out of that buy but why would they do this I
mean you think like poaching would happen in Africa or the whole country
the mint money or that they're starving her on sir stuff why would they do it in
Paris so it's looking at this in the price of the horn at that time was
something like 1.2 million dollars Thomas Browns price to run more than 1.2
million dollars they had that right off in a fenced enclosure with a little moat
right about this tall offense here's a good round why the value to them was to
let me permanency the Rhino that's the value of the organization so the zoo was
doing comes around here's our security control do you think if he gave them 1.2
million euros there just have a little offense
from maybe a gate maybe a wall maybe a fault maybe a guard when you think about
things from the criminal perspective it changes the whole way the organization
should think at the same time knowing both of those areas allows the bounds
were ready to put controls so let's start protecting the organization and I
don't necessarily mean doing an audit not another audit please mother oh god
not another audit when I was a security officer I used to call this the the
binder about it right the others would come in and say are you doing the thing
and we would say we are doing the thing and they'd write a report they're doing
the thing and then come back and go okay are you doing this thing we're like
we're doing the thing give us proof I'm like did I say we're doing the thing
we're not really doing the thing not that one definition and they come back
with this binder if you ordered an audit you see this it's like this heavy they
hit you over the head with it that I cares all the things you're doing wrong
fix it and they give you this great risk chart that looks something like this
like everything from findings most of my wrists were blank stare you
stare at them long enough to go away this is a terrible way to really run a
security program you figure out where to do encryption a better way is is
leveraging stuff we learned from like business continuity or code sorry the
impact analysis right can we take a look at what our critical business activities
are what are we really doing with those things what are the key people in
technology what's the value right what does it all mean so I got a rhino
this rhinos over here the key things of the Rhino is the people that send to see
the Rhino the organization is the ticket sales the
controls for the Rhinos that moat in the fence you get the idea if you think
about it from that perspective we can start to see what the value that round
is to the organization odds have known your own ticket sales and you can start
gathering some good information about what this thing really means the
organization so when you're putting a controlling place on the protect side
you can see you can measure it against what we're trying to accomplish olives
have no darou we will spend quarter million euro that part of the work
previously my point we can spend accordingly and interviews are funny
things only do these things you got to do them very carefully because you get
different answers every time I was doing one in in Chicago it was great the Sun
was rising and my back was the window which I didn't really think about at the
time the windows were open and it was a blue clear day in Chicago which I think
it's like one day 308 but reliably you want and so the the one was coming in
was lotteries teams coming in they're sitting in front of me and I'm just
sitting down I'm looking it down and the lights shining behind their eyes and I'm
like tell me all your problems what have you done to our organization and it
didn't realize like so like 10 minutes into the art in the interview that goes
like a scene from a mafia movie like this is fantastic I just need like a
soundtrack and the cat I can rub I did ask for a cap on it but but we do these
interviews you have to go through it a couple different times so I was going to
get different answers or the person sitting other feeling do they know
what's going on not it works does it work really yes let me talk to someone
else does it work does what work we've ever had that my fare was asking
someone's they had a fire I appliance this absolutely we do we play the odds
and maintenance it's very secure I'm like that's fantastic I talk to now
engineer Devo fire our clients yeah it doesn't like don't tell the boss
folks I'm going to spend the money somewhere else so out of this of these
business impact analysis you come up with a great design that looks something
like this right you guys probably sees diagrams here's our key people here's
our key technologies here's a key so this is the castle we're ultimately
trying to defend against the vampires the werewolves here it is folks
and using BC berp announce system and BIA analysis will allow you to get there
now once you're there you're like okay that's awesome but it doesn't really
tell me where I should apply encryption tells me that it should it tells me how
much money I should spend that man tells me that people would be involved but
where do I feel like the way to get to that is doing data flow analysis right
you go ahead and you say document the process develop the IT systems and
diagrams then if I what we're trying to do this is like PCI DSS and hip up has
ever done those when the person daughter says give us your data flow diagram so
most people go and then they down but for those that don't fail and have it
this is what you're looking at it's taking that business process down one
level you see all the time in healthcare you see it all the time and HIPAA and
both of these are fantastic it's not when I started looking at the castle
return to defend we're looking at what people are doing within that castle
right we're looking at the stagecoach that's driving up to the castle and how
we're going to protect that theater coming in and out an example one might
look something like this we've got a shopping cart system we got our online
big clients web clients are going through firewalls we're getting this
great proxy but a great proxy allows us to connect backs our databases my web
servers and there's another firewall velocity for key systems and internal
right you can map out at a high level of it data flows across and then you can
actually look at the controls which I'm not going to bore any of you guys with
but you can do a control assessment just on that data flow which is also
important because when you're doing these interviews are like do you have
any picture they're like yes we did you're like awesome where everywhere we
promise if you ever done these assessments even if you're not doing the
whole Mafia thing tell me where you are what you know because I know what you
know a big Tommy get will miss you even if you're not doing that and you're just
like hey what the choice do you have they're like we're galaxy MVP that's
awesome we've got Asset Management's also we got
an MDM it's awesome that's fantastic how many asses to have on a management
we've got a thousand that's fantastic what if I told you at need thousand
devices in your environment thank you yeah but we got those controls in place
don't worry for the thousand that we're controlling it's really good 60% of the
time works all the time it's fantastic so well you're go ahead doing that ID
system and I'm pros adjust to those areas which allow us to actually get a
little bit more grain you know it allows us to get closer to where we need to put
the scaredy allows us to get closer to the truth right so luckily encouraged
from the right layers from a protection perspective so the key takeaway this is
encryptions effectiveness is really only specific to the layer in the stakeholder
right the stakeholder who's trying to protect your data and what they're doing
with it and the layer in which it happens TLS is not going to affect you
if you're trying to protect your patient data in the database for example just
driving encryption that can affect you if you've encrypted all of s3 buckets
which is a fantastic unit shards are all great and you've got a old day your
website and you don't have a wife for example from there though you can also
start digging in deeper in Korean very specific controls around encryption I've
got an 8 point control set I can share with you guys you wanna drop me an email
it's pretty open but it looks something like this we look to the network traffic
number one we look at I should actually know this so I'm going to sit down and
been a while so a few slides we look at the active data right are the data and
files actually encrypted if I'm submitting a whole bunch of thousand are
they erected and protected appropriately we look at the data at rest that there
we look at things like purchased and developed applications are they
protecting data appropriately as we're going to third parties think about
supply chain attacks we look at our databases we look at encryption keys and
certificates whether or not they're protected I had a great one of the first
instant response systems I ever worked on or problems I've worked on that we've
been breached because it's terrible it's okay we've got a whack well good
but we think it was down okay yeah yeah but all our files are encrypted okay
good and they all are also encrypted on the transport layer but that's not to be
good and how do they encourage it in the system with gpg good so file encryption
and on our partner schemes of excellent like okay good
so we're all set like yeah we have the keys on the server if you need them
again record scratch wait you say what the the guys have been compromised by
Russian attackers they found that when they went to patch because the past not
apply because of Russian language files aren't there so they came up and a
vulnerability management protocol by the way pay attention servers you don't have
Russian language about patch what so it came in the investigated they were
completely compromised the Russians of the back door had customized their own
keyboards it was great Russians were very happy very very very happy to sirs
and they have all the keys to the kingdom
I'm a keychain I'm the server under this root which is also where Pesci was
running game over that's a good so we have to look at hey are you protecting
keys are you protecting authentication authorization are you doing multi-factor
right if you're doing a federated identity with ping or OAuth is that set
up properly so you're protecting those user drugs because obviously if we
didn't short-circuit that attack surface a lot of the problems go away especially
with the tech we use everything else and then finally give an entire program that
maintains all this overtime get out of these central place what happens
tomorrow next week next month when things are changing especially DevOps
environment so those that eat make drivers we look
at when we assess from hey here's a castle here's our process this is our
way I'm running up the chain here's our technology enables all of it and then we
go through and look at these eight areas of each one these controls one make sure
hey are you doing the thing is there a standard is it written down and also are
you ensuring that it's maintained then people know about it and what have you
because with staff turnover you don't know what the like average time is that
people spend on the company these days is it like six months is a year it's not
very long no those were like I'm gonna tell you
I've been I'm a company for the appropriate amount of time if you're
hiring by the way talk to me people jump around a lot right
and so we jump from company to company often times these things aren't in the
training aren't provided we finally they've got great controls and six
months later someone else is doing it those controls are long or retained or
they've been neglected etc etc so have the thing do the thing check the thing
the next point is that curtains things don't age well this is back to why we
need a program what's things we said today are great
for today probably not be great for tomorrow
just what every conference has some way of breaking some technology like some
point in time and I think like BitLocker it seems like every six months they're
like don't use BitLocker it's been breached like okay wait Excel recent
patch break everything we'll put it back on but it is very clear if you take
something that gets us out that these things you know in a few years you got a
row together like a different cipher together mean team and look at different
ways of putting it on and so it's got to be a living security program this
encryption program desk right and back to the assessment of those sort of
things disk inspector of saying about asking people right when you ask me what
your security is you're not really measuring their security and so many of
assessments and audits use that okay coming over to interview
awesome come on in so be great put on some lights yeah fantastic but what are
they what these assessments are measuring we think about spilling right
the feeling of how secure they are and there's always that deeper reality and
we need to get past what we feel to actually doing the testing and making
sure what isn't a deeper reality those are often the control tastico
validations a you see again encryption let's test that stuff of traffic just
take a look let's make sure it's sample them the machines are doing BitLocker
those sort of things all right so protecting the business
want identify critical activities - do that data flow we want to make sure that
we know what technology supports and then apply those specific controls that
covered that's what the tech side I was talking about looking at from the
criminal side that criminals were going to rush up here jump them out jump
thanks killer in a run off the horn and make off the million euros that's the
prevent side we oftentimes hear about all these scary things that security
people need to be worried about well after them say about you know
security people should be up all night because they only need to be right once
but you need to be right every single time or every always hear about these
sort of things whereas here about nation-state actors are out to get us
those sort of things and I think it really matters just like when we're
teasing a part of an organization to see what the technology isn't what
stakeholders are and what they're doing that we have some tease apart the
threats to get similar insights and some ideas so you're like things like naming
the monster it's like we've got a description its rightful owner anchors
the curiosity goes over the stereotypical hackers it's weird that
many of us are not nostalgic for the ecotripping curiosity lone actors but it
is the case so you take those monsters you look at instead of threats right the
lone actors driven by revenge they didn't pay me right I shall take them
down ask me not joining your company and
foreign companies saying we will pay you X amount of money to install a backdoor
or steal data from us closer to things
activist group actors right the people driven by cause anonymous I was
mentioning earlier before I got in stage that I'm Monday I'll sit down with a
bunch of folks and I was by far there was one I think most is more like half
my age where Gavin around but okay can you tell us about scary in the old days
yeah yes do me like floppy drives what no like anonymous like 2010 was the old
days thanks thanks I would tell you about those we wrote dinosaurs I greatly
bought off anonymous with median the Legion
so yeah activist but there's stuff that we still know that they're going after
companies and everything else cyber criminals the organized crime waves that
are all over the place the gangs by the way and getting back to Chris Marcus our
flight just left I love toys like here's a great DevOps case study next slide and
by the way they're criminals yet a point about how it is the only difference
between infection rate and release rate is how happier DevOps manager is like
that's fantastic so if you didn't see that check on the video bye alright so
cyber crime was known impersonation state which is what most of us are most
freaked out about because we're always hearing about China and Russia and
everyone else during the attacks so if you take a minute and we map the
business we understand what we have and what's in the way and what it's worth
and how much we get to the cast so who wants to get to the castle we can then
start figuring out what is the real danger these threats and these debts are
a little bit old but I still think that are very relevant guaranteeing a couple
percentages for what we're facing and it starts up something that's nation-state
would most people hear about with most no concern about it's only about 4% of
breaches when I was getting this data insider threat or espionage another 4%
hacktivists 11% pretty interesting I would have thought they would have been
small under their law because there's a lot of them and the
rest of it is on sever ground it's almost all cybercrime
so do you think about a prioritization right like the the old proto principle
oh yeah you know you put some of the results coming for some effort but we
can just attack off cyber crime imagine how fewer threats we have and
how fewer things we have to face which is again where I ii think encryption is
incredibly important with these things but this is what this is what we're
looking at right this is this is the scary night in which we operate under so
when we start focusing in on what controls to put where we can look at you
know where the organization Center is value which I covered earlier we also do
to look at where criminals are financially motivated what is making
them go after us what are they really trying to get obvious as things like
credit cards which are now only like ten dollars I feel kind of bad for the cyber
criminals it used to be so much you should be like make 150 $200 off credit
cards but then it crashed crashed right around like 20 centers so because
because and this also makes me throw wrote bad about cybersecurity because so
many credit cards are stolen like targets now that happened that people
are like oh credit cards are no longer worth that much we could there's a glut
of the market so spline demand is work you mean crime genre ten bucks
first my Dendi is now we're twenty bucks used to again be several hundred dollars
Thank You anthem for driving down the market personal health information about
$60 so why this is important if you know the area of business you're looking at
and the information within those databases and information with those
files you can do some simple math x number of records by something we
doesn't these numbers change all the time you can find you know threat
reports that gives it I could number but you can time somebody's number and you
can say my rhino horn is worth a million and a half euros you can talk to that
about the people are like no but we only want a little moment events because
everyone wants to see it you're yes I know it's a beautiful ring a million and
a half euros right you can do that math and you can start to open up a lot of
eyes and then you can start doing some threat assessments right what did the
criminals gonna do how they gonna get there and what's going to look like and
you can start using some good friend colleges it's not the whole like here's
an IP address here's the name of the the new nation-state hacker group here's a
new cool of name of a et group but what are the likely actors hey right now
we're talking criminals one of the likely assets or target credit cards
whatever maybe what are the vulnerabilities now we look at those
systems waiting back early when talking about protecting we look at those
systems to say okay what are the bombs the the anchor points they're criminals
when we used to cross through those systems to get to those resources
what's the path or anything I know we can filter all of the intelligence all
the fur intelligence all over the world that gives to us which will bury any
team anytime you turn read at all you can filter it all just by those
connections down the things you actually need to worry about me concerned about
and then your world becomes a lot a lot simpler and you can then go ahead and do
some threat bombing because every day take that threat that we've got some
stats on but we know how likely it is there's another life cycle around I'll
show what that looks like in a minute let's identify things this thing
controls we have what what detective what what preventive will get the way of
it and let's go ahead and design some specific threat specific encryption use
cases out of that very specific very point solutions to go ahead and dress
just a threat you do that enough it's something strategically what the county
themes are and there's another one ways to threat model there's a million one
ways to do it I had to just take it was a very simple whiteboard and just draw
it out right here's what we have we're trying to protect they're our friends
and family we're trying to protect their way in there trying to figure castle
this is the patented van hosing throughout my own case you guys are it's
not really bad if you stay alright but all right so we've got our monsters and
obviously drag Club really doesn't care about anything else I'm castle but the
werewolves want everything else so we can start layout for us white border
cross here's what they're going TAC here's what we're gonna go through and
then we can start say okay what type of things will stop them you know we've got
our get our holy water we got our bullets we got an amount
we got our walls these are threats these are controls these are assets very very
high level it's a great table top conversation to say okay to start
mapping these things I'm talking about what has the most stopping power what is
going to prevent us from going where I'm starting to say really my my holy water
does not seem to be very effective I guess don't hide behind me but you can
still buy me a drink in a bar you can start laying these things out and having
some great conversations with folks about where you need to invest and where
you don't and what would work and what wouldn't now practically speaking when
you go to the next level you're gonna want to document the screen alone right
up the tak path there's a lot of conversations we've had about this you
can hit my YouTube channel to see whole videos about how to do this we can lay
out all the steps are going to take right across a consistent kill chain or
attack mitre framework or whatever types are going to say you can lock that out
and then do a Sankey diagram which looks very similar to the earlier diagram I
displayed but a little more complicated say here's our threats here's our
defenses here's the assets and you can follow through and see what asset or
what controls have the most fat the part where you need to invest where you need
to focus in that right and this gets to another point and I just touched that
I'm just barely but I think it's important to really pull it out but not
specific threat intelligence it's not intelligence it's just noise we're
getting too much stuff coming at you and it doesn't match your business and it
doesn't matter the criminals are going to attack and it doesn't matter to the
bonobos you have it's not necessary threat intelligence
great information great fodder let's have a good conversation about it maybe
but there's just so much other yeah I think it's absolutely paramount that's
got a good filtering mechanism to get up through all that sort of stuff
alright so specific intelligence needs to specific examples right we know that
like for example hygiene will reduce the harm so if you're patching you do sort
of things over just a lot of accidental we can reduce the
services to sway the casual attackers and script kiddies the Longboat
assessments and looking what's out there and what could happen we could reduce
the lure right what is attracting the criminals it's also something we don't
often times think about with the whole like traditional risk assessment
approach but if criminals don't know what you can but less like their attack
you if they're the dedicated criminals who are going after and I'm talking
about the people are scamming us every day at night that goes back to reducing
the attack service but you can start plotting out different strategies to
attack and go after different types of threat categories and then of course you
put encryption place would now earlier I said from the protects that encryption
is layers for certain stakeholders over the tank side encryptions effectiveness
is right specific what exact our we stopping what exact front so redress and
why in what amount of money are they gonna make out of it will drive
conversation about what amount of money we should spend I'm correcting it right
and once we get there now we can finally talk about encrypting a lot of people
jump right to the step we have data we must secret we've got security
compliance programs we must have crypt leaving out all of that conversation
what we're trying to protect all the conversation what we're trying to
prevent most people want to jump right to your why just the sexy stuff you want
to know hey what global encryption how are you running how are
you doing your cue rotation right those are the fun conversations you want to
have now let me tell you about our business and what our revenue targets
are and everyone in the bar goes off so you stop wolf there's a door over there
no I need to jump right into that now D so when you do that you can start doing
some encryption so here's a couple case studies in this particular case like
what we did was in this flow we found that we've got medical personnel the
wrong in all over the place there's a personal laptops that's always a problem
they're going into this remote desktop on the connection to the work computer
to get into some stuff from there they're in the EMR they don't ask the
files and this was an overall data flow map that we got it over several days was
getting interesting about this so microphones are sorry down below you can
see like yellow is someone encrypted red is not encrypted and blue is is accepted
for data in motion and the keys are red I mean cryptid for the locks it's not
blue encrypted at rest it is okay make sense so what was going to extreme about
this is we're having this conversation and we're talking to the sea so alright
so your portal that people are using to log into this that station yes
absolutely awesome good yes so we will mark that oh wait right this perspective
that earlier conversation on having assessments about a feeling you're
feeling is encrypted I think someone told me it seemed a
cryptid so what happens if someone types in HTTP and all I'm doing though
well what happens if they did I don't know we tried it HTTP works right away
no big deal we're in it's unencrypted like maybe
they do some you never color it's like I will fix this speakerphone thousands of
them the i-team in turn we've got a problem
eventually okay sure let's fix this in a few minutes people in there submit a
ticket no problem abundant so we got this problem
people are telling H you can type HTTP to read support them long pregnant pause
and I swear I could almost hear the helpdesk icon all right fine you could
say it goes well yeah of course there what even in verse there well that's how
we train them to do that light yes and then I didn't hear the rest of
conversations I pick up the phone but if you a train the IT manager had trained
everyone and even sent up a little helpful cards the roaming medical
profession on the personal laptops here's something into the portal of
typing HDTV bubble pop whereas security professionals and I renounce what we're
great we got the latest version of TLS no no can't test it right get tested
so that was one area weakness we had Empire another thing is the data
warehouse no multi-factor authentication the EMR did have on track
that's good you know did that's goes over like a this is true that data
warehouse have two factor authentication well it'd be a little bit harder okay
was intended or else our patient records okay on how many patient records again
Mac multi patient records by voters to Moses told here's your rhino horn it's
just more really good because I can feel like we can do multi-factor
authentication they can be good good awesome so you can start having some
good conversations around a very simple diagram like this where it would be
otherwise lost in the weeds if that makes sense with that we can do that
awesome diagram here they wanted to do stride so we're looking the threats we
map devoted to different protections you correctly network traffic I mentioned
that already fix the identification and multi-factor and you can start to see
where most your stopping power is to get to those assets they healthcare and
racially crowd to the infrastructure make sense so we're able to then use
that as a diagram to explain where implement these new security controls so
here we found some health information was encrypted
we found some passwords or we in the net multi-factor authentication we ran that
those eight point controls I mentioned earlier we've made a great spider
diagram doesn't like a spider diagram every presentation of spider
security is built around spider diagrams and then we went ahead and built that
business case for them to go ahead and raw those additional security controls
that was how we did know it was a layer of abstraction allow us to have some
really great conversations to move the ball forward another example on the
payment side looks something like this the folks had again personal laptop
sometimes laptops is fantastic there could be no
website and this is a traditional model it's only encrypted the endpoint and
everything was I'm hurt because you guys remember back in the day I don't mean
back in the day like 2010 folks I mean like back in the day where a person was
like overhead and slowed things down so I'll make these great diagrams and
design models or it only occurred to the edge yeah they bought it they built it
so it was unencrypted through everywhere else and then the people go to the
website the website with the car donor data that will go to a payment service
portal to push the payment processor back in Florida the past ie the payment
processor would send the off codes into this data warehouse and that will go
ahead and pass information is being paid or not paid what was interesting about
this is immediately we're just off that medical owner like look at it or else
this is why it's so important to actually dig deeper because in this
environment there's actually no information worth stealing the data
where else at all and they spend a lot of time already thinking we need to
secure the data warehouse yeah we do and we're looking like but it's got
transaction codes and user names but no passwords or card data like it's a thief
I'd be really bummed if I spend a whole bunch of time trying to steal this data
where else like man I got gypped so we didn't necessarily focus there we did
focus a lot on the transaction data itself over the network especially since
this was an environment that was cloud when use cloud air quotes was
actually hosted environment not necessarily ashore when I was when these
IT infrastructure providers and it was running across other environments and
there's a whole bunch of complications so I think you know that you would wanna
watch there you want to watch some of the data on the website but then the
back then probably not so much so we map this out there because of some
of the things we looked at in correcting that active data as was moving through
the environment cooking the credit cards once those accepted protecting that data
in the apps and then we're also looking at some spoofing some key management
because they really wanted to get very specific in their key management
handling so this particular one we went ahead
and the mapping as you can see most of the concerns were around those
applications the databases we use that to build the business case we actually
ultimately move them to tokenization we're recruiting than credit card even
at a very high level and keeping an encrypted token throughout the entire
system which does bring up a good point tokens are pretty damn cool promises a
lot of times we want and every day that's useful it's helpful pass around
if he's good but but once it's stolen obviously that things happen so how do
you have the same token or same ID there's you can process it it's actually
recording with everything else but still be able to move it throughout the whole
system and on what I see a lot of monitor system doing is we decide the of
encrypted everywhere encrypted immediately the minute the moves inside
the system this is the exact opposite the old design pattern where you would
have it only occur to the Internet but we all trust our environment right this
is the the encryption version of zero trust the data moves in its immediately
encrypted it's only decrypted if someone needs to use it your way you do that of
course by using some of these api's that they do the decrypt but but predominant
mover through the entire system and the decrypted State so for example three we
had this distributed site we looked at a lot of different things here the event
of back Pinero's windows they have single sign-on server we were concerned
about there's this corporate network the different trust zones the web crime
reporting all that had multi-factor authentication except the API
interesting link so we had to fix that and that never happens all right you
never have like oh we've got an entire environment configured with multi-factor
but we forgot one little thing no company would ever make that mistake
like Microsoft with office a year and a half ago okay I'll let you guys see that
they actually didn't have multi-factor than that Outlook Web Access API so you
grab a token there and ask the Home Guard officers fixed bias pretty snazzy
so they've got Mon factor there we're looking at the web
certification service and the way that this was ultimately architect was so
that when the data was processed by the witness mine at the web pine or anywhere
on there it would be encrypted no stay encrypted throughout all these
tiers and we started her to the database we start encrypting the data warehouse
it's a token and that became the key that everything else was run off of and
it was only the correct if someone needed to use it and had a building to
use it so if he needed a credit card they needed to take a look at that
credit card you click the button yeah show me the credit card
that would actually instantiate the decryption action that make sense
so that is the threat while there I'm looking at my clock we got four minutes
so I'm going to zoom through a few slides here so at the end of the day I
mean all controls make better criminals the better things get the more likely
the attackers are going to move up the stack and find new and better ways to
attack which is why things like key management becomes so important and I
would see without key management system corruption right it means if you don't
have those keys protects not even purchase just encoding so as we start to
look at the XIT systems and figure out where to do the encryption you can get
the more technical diagrams get more deep into it you can look at things such
as application layer encryption where you're actually doing the encryption
using something like an API or you can look at format Missouri Krypton when we
do in picked everywhere I actually prefer form a encryption preserving
phishing presenter can flow the legacy systems like mainframes god forbid use
that mainframes with offense it do so it can flow through and all you're saying
reporting would work and at the end of the day with that very complex system we
had a threat model of something like this and were able to show a nice layer
where the encryption was and why it was from the protect side we were to show to
the threat specific version where it wasn't why was in the prevent side so
next steps if you want to do something like this obviously we want to protect
this organization instability to its mission how by an employee some
encryption strategically making sure where the encryption is placed is
the business processes trying to protect back to my Rhino example making sure it
protects that level and making sure that takes into account where threats are
actually trying to do and being so aware that the media often times is hyping up
threats that are unique and interesting but also unlikely especially unlikely
before a lot of the organizations that were working with when you do that and
you take this approach you can work from the bottom up starting with the
traditional IT diagram so here's the environment we have news we're trying to
protect moving up to data flow diagrams here's how the deal is flowing through
the networking what needs to be again this relies heavily on what we've done
four years of the PCI HIPAA domain and then going to the business side of
looking at the business process from there doing very simple threat modeling
I love tabletops of others sit down with organizations and people from all across
the business and ask them what controls they have the answer is always fantastic
do you have that control up so they have that control so as the CIO the seaso is
doing C so yeah if I can try absolutely we've got that bobbing Network easy Bob
do you have that uh-huh what what no I don't think we do I think
that's out desk has to have this no bro we people that a long time ago so these
sensitivities are always in sizeable you get everyone in the room and you have
that conversation your whiteboarding and you're talking at a higher level you're
gonna have time to get engaged and have those conversations and move the ball
for in a significant way next steps you're gonna do this gonna build a
program like this it looks something like this next week you know identify
your business activities and the threats in the first three months figure out
what's critical identify those data flows map that enabling infrastructure
build those controls do some of those threat modeling again folks just how
much critical I was working with that hospital and they have like 18 systems
and business flows and everything like you know we're gonna focus your health
information this one's good where'd your payment bridge that one good let's start
there so talking and targeting in the critical ones for the first three months
and on the six months building up a habit and
to do this again again with nature's building an actual program that protects
the businesses and prevents the threats I have zero time for questions I'm sorry
kitchen ramp doors in conclusion key takeaways key takeaway one if you're
going to start holy water clearly labeled body clearly labeled Bob very
important pro tip do not make something that can't be so I'm not sure what that
means wrestled other important points for foreign threat modeling there's so
many good resources out there to do it's so easy these days and it's a great
starting point a high threat specific encryption not encryption or every way
about what is the actual threat we're trying to stop with this encryption how
likely is it to occur what trying to do apply data centric encryption where's
the data we're trying to protect was it mean organization and how we're
conducting on that layer and build an overall program that allows you to do
that again and again and again have you some great conversations about
the threats having some great conversations about the business but
ultimately looking for better ways to secure things with that thank you so
much for spending on so the guys are appreciate it
you