Behind the Perimeter: The Digital Maginot Line and the need for re-thinking Peer to Peer communications
No ratings
Presented at BSidesRaleigh 2015 by
"The recent wave of security breaches that have occurred in the last 24-36 months have had one overwhelmingly embarrassing fact, The hackers done the digital equivalent to walking out the front door with the merchandise. Today I look at the expiration date on my newly replaced debit card, the 3rd in the last 2 years as a result of retail breaches, and think to myself ""yeah right"". Retailers need to understand that they will be held disproportionately accountable as it is likely to be their customer's 2nd or 3rd breach of their information and consumer patience is wearing thin. Today's perimeter-based security strategy is essentially a digital version of the Maginot line. The time has come f or a paradigm shift in how we look at peer to peer communications and strategies for protecting our networks behind the firewall. This will require a shift that includes system owners taking some responsibility for their own security as well as the adoption of a more agile,, ""hand to hand"" security measures by analyzing peer communications behind the perimeter. System Owners Taking Responsibility for THEIR security: The presence of a police department in my neighborhood does not absolve me from taking regular security precautions such as locking my door, calling the police when I see something suspicious or keeping track of who comes and goes from my property. Yet in the digital world, there is th expectation that the INFOSEC teams have a ""crystal ball"" and the burden of security has shifted irrationally to the incumbent security apparatus and system owners have basically taken no responsibility for their security. Advanced threats cannot be solved with Algorithms: In the hand-to-hand world of advanced persistent breaches a human threat needs to be met with a human counter-threat. An even correlator is not just an engine that aggregates events, but an actual human being who looks at the data and says to themselves ""HOLY !#$! what the hell is that!?"". <> The discussion will highlight some of the recent breaches and strategies showing how ""advanced persistent surveillance"" could have helped stop the breach as it was being assembled or at least discovered it in hours/days instead of weeks/months. I will i nclude strategies for drafting system owners back into security and discuss ways to thread the INFOSEC and System owners together to provide better synergy to what has become, in some organizations, fiefdoms separated by moats. "