[Music]
all right welcome everyone my name is
Matel I'm a security specialist at the
lastic we are a company behind the the
elk stock or the elastic stock
uh it's a platform uh with open source
routs with many different use cases and
it's used a lot for to ingest security
events so if you if you think about
security information event management
being able to visualize observe what's
happening from all the different devices
that an organization has to monitor
that's what we do and in the recent past
in the last few years we have introduced
a security solution that also has
endpoint security and Cloud security so
in addition of observing we also protect
and prevent different types of
attacks so for today I'm going to be
talking about what I see that the common
Trends I see many organizations do
primarily in North America to defend
themselves from bad guys and Bad actors
and uh there is quite a lot of
commonality uh going from the east coast
to the West Coast and things that
actually work so my Approach for this
presentation is really to talk about
approaches that we see work in helping
organization minimize the risk manage
the risk and protect themselves from
adversaries uh as a security
professional when you work for an
organization uh you always have to
balance the boundary between risk and
growth for the longest time we seen the
security team has always seem almost as
an impediment to growth slowing things
down
whenever I need to log into an
application I need to do use the
multiactor and all those things and some
people hate it because they see oh my
God I know this is slowing me down I
could be so much more efficient if I
didn't have to do all these things all
these extra things that the security
thing the security team is asking me to
do so what we are seeing in the last
couple of years recent really is uh a
trend that started with this growth in G
digitization so what I mean with
digitization if you look at how you
interact with different products or
services that you use today you use
technology maybe a web application a
website a mobile app so these
Technologies are now Central in our
organizations generate revenue and
they're acknowledging that security must
be part of that and we're seeing that
Chief information security officers they
start to report now to the engineering
leader or the CE EO so to the growth
part of the organization they're no
longer something separate a necessary
evil that you need to have for
compliance but are part of what's needed
to help organizations grow and to manage
risk we see that organizations they tend
to use weight to many tools right we see
45 plus different security tools that
they have to use different to manage
there is a shortage of Security
Professionals and of course the
geopolitical risk that we have that
we're facing every day with different
War and things like that so there is
good in all of these and the first thing
I want to show you is that organizations
now they start monitoring their
applications and their
infrastructure not only looking at the
app time and performance but they also
start thinking about the cost of
downtime that is caused by cyber threats
it's really the same thing if you're if
you have an e-commerce site that you use
to to sell your products as a company
and it stops working whether because of
a bug of an outage or a Cyber attack the
end result is the same you lose Revenue
you may lose customers so organizations
are becoming more proactive and they
also look at security as a way to help
them generate Revenue so Security
Professionals now are start are becoming
something that is see as something
helpful as part of the revenue
organization so for the framework they
I'm going sorry the framework I'm going
to use uh for for this talk we talk
about three different aspects technology
process and people so as an organization
you have two different asset type of
types of assets you have your your team
members your people you have technology
that you can acquire and then processes
that basically Define how you're going
to use the assets you have available you
can balance all these three right you
can try to do everything without
technology or you can try to do
everything just with technology without
people but really you need all three and
the outcome really is to balance this
tree to reduce your operational risk so
I'm going to cover three topics today
the first one is really a foundational
requirement if you think about what
organizations can do to protect
themselves to protect their assets from
B doctors is to gain visibility
you cannot protect what you don't
observe and that started with the
introduction of an acronym that you
probably have heard many times security
information event management Sam and the
whole idea behind Sam is that you want
to have a way a central place a central
pane of glass that you use to visualize
what's happening within your
organization that's still very
applicable today that's really the first
things the first thing that
organizations do gain visibility once
you gain visibility you want to find
ways to reduce as much as possible the
time to protection ideally you want to
be able to protect prevent something
immediately before any damage is
done the next best thing is something
happens an employee clicks on a fish on
a on an email like a fishing attack you
want to be able to detect that as as
soon as possible and trying to trace it
back to make sure that no other
employees have done the same and the
last part really is being able to manage
all of these efficiently uh you're
dealing with small teams I assume none
of you have has too many Security
Professionals at your work that don't
know what to do there is always too much
to do I'm going to tell you what I see
organizations do to manage their teams
efficiently so first Broad and deep
visibility how many of so so first of
all what do you want to what should you
observe ideally you want to observe the
entire attack surface the attack surface
describes anything that a bad actor
could attack to gain access to your
assets or intellectual property and I
use this photo to describe how the tax
surface today includes a lot of clouds
this is a common Trend that applies to
all Industries all organizations I work
with
at different levels of
maturity no one is wants to get into a
data center business anymore no one
wants to build a data center every
organization has some initiative that
involves moving workflows to the cloud
many different benefits to that that
also includes challenges that come with
it how many of you have heard of the
miter attack are you familiar with it so
the miter attack back is uh was
introduced by m a government funded
organization to catalog all the
different
techniques and techniques ttps that we
see adversar adversaries commonly use so
these are all actions that if if you see
them in your environment they may be
tied to an ongoing
attack the MIT attack can also be
used the other way see I want to where I
where am I losing visibility am I able
to catch all these techniques within my
environments what lock sources should I
ingest to be able to gain visibility so
this is a great
framework to to assess your coverage
what am I able to see within my
environment and it's also great for your
security analysts whenever they see a
detection alert come up if that
detection alert is tied to a MIT attack
technique they can it can help them
understand understand why would a bad
actor do this what would they gain so
it's really helpful for that reason as
well so I mentioned this earlier 95% of
new digital workloads by 2025 will be
Cloud needed so we know that the
movement is there so if you're thinking
about how to what should you should
invest on when when it comes to skill
set development your skills think about
learning more about Cloud because that's
that's the re that's where the industry
is
going the cloud provides a lot of power
and flexibility it's very very easy to
stand up workflows move workflows to the
cloud create an is true instance share a
file on the cloud in an S3 bucket it
also adds a lot of
challenges because it's too easy to do
that right and it's very and it's also
new to many people even if you are an
expert today for example in
AWS suddenly your employer may say okay
to reduce our risk we want to have a
multicloud strategy we want to we don't
want to use just one cloud provider you
have to start using aure or gcp and
guess what yes they're similar but
they're different and the chances that
you do an error by misconfigured it or
not doing it right are pretty high
right what's the good news in this
because again the topic of this
presentation is like what's right in in
cyber
security once you start deploying
workloads to the cloud you're no longer
responsible from everything going
starting with physical security I still
remember when I studied for my cssp exam
many years ago there were a there was a
chapter that was all about physical
security and Sprinklers and Fire
Prevention and I was like why do I need
to study this and learn these because
that that was a thing at the time if you
need to build a data center you need to
think about everything including
physical security and how to restrict
physical access and all of that once you
move your workloads to the cloud you
delegate a lot of that work to the cloud
provider so this is an example with AWS
so everything you see at the bottom here
the responsibility for security of the
cloud if is delegated to the cloud
provider of your choice you only worry
about the security of what you deploy in
the cloud so this has a significant
implication of the work we do as
Security
Professionals an example one of the log
sources that they see organizations
paying more attention to now because
they start having the cyclos to do that
is application logs their application
logs this is something that in the past
you would even think about because we
were so busy chasing firewalls witches
and perimeter devices and cameras and
all those things that you have to worry
about now that you only worry about
deploying your workflows your
applications to the
cloud you start thinking about oh my God
applications make up the majority of the
attx surface I'm responsible of so I
should be pay attention to those
right this applies also to SAS so this
is not specific to security but when you
work with a SAS provider again the sus
vendor is in charge of securing the
infrastructure the data centers whatever
they use to power the service that you
subscribe to you're still in charge of
protecting and making sure that you're
configuring correctly in the way you use
SAS if you look at the miter attack
Matrix for for cloud this is just an
example you can find many you can find I
didn't even know they existed until not
long ago you can find this for office 3
365 for different type of s services
that are becoming really popular you see
you don't really have a lot of
techniques here very it's much smaller
again because the focus here is much
more
narrower that really related to what's
important to you the workloads that are
important to you as a company that you
run on the
cloud and this is another Trend that you
may have heard of and I thought about
spending a minute talking
about uh in the concept of Sam ingesting
data gaining Central visibility the
challenge has always been can I afford
it there is always a new log Source you
want to gain visibility across your
entire tax surface you start talking
about ingesting application logs the
cost keeps going up and up and up if
you're company is doing well the volume
of logs is going up because you have
more customers you have more usage and
so on so what are vendors doing to
manage that cost so there is this trend
that many refer to including us as
serverless but what serverless truly
means is using the cloud as the cloud
was designed to be used if you use the
cloud as the cloud is designed to be
used you Decap store
from
compute and the idea behind this is that
you don't want to pay to keep data
searchable just because you need to have
it searchable you want to be able to
store data in an object store like S3
and use compute to search it only when
you need it and pay for that compute
only while you're searching the data so
this is a trend that many vendors are
following that will end up reducing your
cost you only pay for what you need
and this is in a way a necessary evil
because many s vendors they got to a
point where you can no longer scale them
both financially and technologically
because you need so much compute that is
no longer affordable to be able to gain
all that visibility across the the
entire ta
surface all right time to protection so
once you have all the
data stored in a central place how can
you prevent the detect and stop Bad
actors before damage is
done again MIT
attack if you look at each column of the
MIT attack each column of the mital
attack is is a stage of the Cyber kill
chain starting from reconnaissance
ending in exfiltration or impact the
goal of US security professional is to
prevent or
detect as left as possible in this m in
this Matrix you want to be able to
detect before any damage is done so how
do you do
that using a layers
approach starting at the end point or at
the edge right you see the EDR EP
industry has become really really
popular because many attacks start at
the end point whenever you have an
employee downloading a file double
clicking on that file opening an email
attachment that may include Mal so
that's that's the best way to start
right you want to make sure that you
have a security in place at the end
point there is not everything is Mal
word though if you look at my attack
tdps each of those techniques they
usually require
visibility at the kernel level what do I
mean with
that process file changes registry Chang
Chang es network activity all that
visibility are events that are not
natively logged by an operating system
if you look up the windows event lcks or
if you look at the Linux logs you those
are not events that are logged natively
by an operating system so that that same
endpoint sensor that you install to do
the protectional endpoint can stream
Telemetry back to a
Sam and the Sam can look then for the
known bad type of ttps again going back
to minitor attack this is an example
execution of a file written or Modified
by a PDF reader this is no Mal but this
is an event that should never happen and
the only way to catch this is to get
that level of telemetry from an end
point so this is what many refer to as
xdr today extended detection
response you not only need to have
prevention at the endpoint itself with
an endpoint agent but you need to
augment that with Telemetry that you
generate on end point into a Sam and
using detection rules to look for type
of events like this one and the majority
of MIT attack techniques that require
this type of
telemetry when I work with
customers and I as them what are the top
use cases that you have in
mind what keeps you up at night that
expression but really it's like what
what what are you the most worried about
what type of attacks do you care the
most about and the number one answer I
always get malicious insiders
compromised
accounts how do you detect
those this is where machine learning
comes into
play here you're not looking for The
Gnome bad those miter attack techniques
or for malware type of activity but
you're looking for anything that looks
different than what was seen before the
idea is is to look at past history user
Behavior or entity Behavior unusual
processes that pop up on a host unusual
network connections that starts
happening and flag those those are
referred to as anomalies so that's a
third layer of approach and again you
need all of these right you know you
want to start preventing on the endpoint
stream from the endpoint to a Sam use
detection rules map to miter attack to
detect those techniques and overlay
machine learning on the top of that and
lastly threat hunting threat hunting is
what everything everyone would like to
do but very few get to do because
they're too busy doing everything else
dealing with fires and the idea behind
threat hunting is I want to just look
around and see if I find something that
looks bad but you don't really start
with an alert you can def it requires a
lot of expertise these right because you
kind of need to know what does this look
suspicious or not and uh and again it's
like I work with many
organizations and only the most like
government organizations are those
usually that have the the skill set to
do it larger Enterprises they all want
to do it but they're so busy dealing
with the daily fire to to have the time
the free time to get to do some
threatend and uh and lastly you may or
may not have noticed maybe it's in the
middle of the the screen so I put like
an arrow going left there is this uh
movement that finally is gaining
traction it's called the shift left
movement the idea is that what if we
spent some time before we release some
software to make sure that we secure it
that we think about
security before we release it when we
configure it instead of trying to just
release the software that comes from
engineering and then we'll worry about
security
later so what about Cloud so we
mentioned that cloud is becoming really
popular uh different levels of maturity
but different organizations are moving
workloads to the cloud it's very easy to
stand up workloads in the cloud but how
do you protect those work
clth kubernetes is used a lot as a mean
to convert your
applications in a way that can be easily
moved from on PR to the cloud from one
cloud provider to the other and it's
becoming especially in the West B
basically the def facto standard to
deploy
applications and uh kubernetes is
becoming really popular but again it's
new to many right
and uh Shadow server they they estimate
that the majority of kubernetes servers
that you can reach on the
internet allow some level of
access and Gardner estimates that
through
2025 pretty much all the cloud Bridges
will be traced back to preventable
misconfigurations so think about
that so Cloud super powerful new to
many it makes it very easy to deploy
workloads but it also adds a lot of risk
because people don't really know how to
configure it correctly it's very easy to
not click on a check box miss something
and open up something to the
world so
uh have you heard of cspm some of
you so this is becoming uh popular in
this context Cloud security posture
management and there is no magic to it
CIS came up with a set of benchmarks
bench think of them as best practices
for configuring the cloud or for
configurate comates in a secure way and
this type of
Technology basically does scans on your
kubernetes servers or your or your on
your Cloud providers API and it comes
back with a with a set of findings these
are all opport opportunities to secure
your configuration in the cloud so very
easy to do and this is something that
can really help you all to make sure
that what you deploy in the cloud is
configured correctly again cspm yet
another acronym but it's very
important uh to make sure that what you
deploy in the cloud is
secure all right I only have a few
minutes left so the last thing is
operational
efficiency how to do more with less why
do I say that so if you look we are we
we are fortunate to work in this
industry so if you're all here today
you're if you're either working cyber
security or you want to be in cyber
security there has always been a very
high demand for cyber Security
Professionals everywhere I turn I see a
new cyber security Boot Camp or program
to train cyber security analyst because
there is such a high demand for cyber
security analysts so this is the outlook
for nor for for the US so you see we
have a little bit over a million cyber
security employed professionals and
we're looking for for close to 800,000
of them so a lot of demand and
specifically for
Wisconsin right so 11,500 I guess uh big
part of that number is here today right
big part of you is here today and we we
have like close to 8,000 job opening so
there are a lot of amput chairs close to
you and if you think about
who do you think is going to fill those
Empty Chairs likely someone that doesn't
have a lot of experience unless you
steal someone from another
company so and we know that we cannot
really move much the people aspect right
so what can we do when it comes to
technology or changing the
processes to help us reduce
risk so the first thing try to find
solutions that are easy to use right if
you try if you find a solution that
requires a steep learning curve uh it's
going to be harder it's going to take
longer to train uh new new team members
to use
it speed is a
factor that's why many come to us as
elastic for example because we're known
for the speed of search and if you think
about what you do when you do
investigations you're searching through
true data if you have to wait an hour
before you get search results back how
many investigations do you think you can
do in a day right that limits
you less products so this is a we're
seeing it clearly with this recession
whatever you want to call it that is
happening today organizations are
becoming more conscious in the way they
spend
money many organizations I work with
they have new policies in place if you
want to add a new product it must at
least replace a product that you already
have we don't want to add anymore and I
covered it earlier there are already way
too many products that we have to use
and learn how to
use sore is becoming popular security
orchestration automation
response the the big problem promise of
sore in the early
days was I want to automate
response basically I want automate the
job of security
analyst no one does it I work with many
many organizations everyone wants it but
when it comes to the the time when say
okay do you want to do you want to fully
automate this
response no one wants to do it because
it's too risky the the human always has
to be in the loop to some
extent but what sure is becoming popular
for is automating tier one tasks so
really tier one analysis things that are
tier one anal have to do over over and
over we want to be able to automate
those out of the box content find
solutions that provide detections that
you don't have to create leverage try to
re work of threat researchers that that
develop
it and I'm short in Time free time to
improve like companies like Google and
others they give their Engineers 20% %
of their time a week to work on a
project that can help them be more
efficient and that think about the
benefits of doing that if you keep doing
what you're doing and you're always very
very busy things will never change but
if you if you stop and take some time
even just a couple of hours every week
and say okay what can I do to help me
going forward that can help you can help
the organization and then msps are
becoming popular as well and I'm out of
time I don't have time to recap but
thank you for joining and sorry I had to
speed up a little
bit and no worries about this no worries
and uh and again enjoy the rest of the
[Applause]
conference