RSA Conference Day 3 - Thursday
"Make IR Effective with Risk Evaluation and Reporting” - Mischel Kwon
Mischel Kwon, President & CEO, MKACyber ( https://twitter.com/mkacyber @mkacyber )
Justin Monti, Sr. VP, Security Engineering, MKACyber
Mischel is a former head of the US Computer Emergency Response Team (US-CERT) who left several years ago to start her own consulting and services firm, MKACyber. In this talk, she and her engineering lead presented their methodology for giving a quantitative basis for communicating the risk created by ongoing cyber incidents.
This was one of many talks that emphasized the need for risk management to adopt more objective, quantitative measures in place of leaning on pure judgment and expertise. I was resistant to the idea at first, because I am not convinced that most organizations have much reliable, objective data with which to begin working. As a result, I fear that a "garbage in - garbage out" process will result, as people assign numbers or categories to things in very unscientific ways and then treat that as data, do a bunch of math with it, and call it "science." Ultimately I have come to agree that quantitative analysis is a must, but that organizations that want to adopt it need to figure out where they can mine reliable data with which to begin.
"Sophisticated Attacks vs. Advanced Persistent Security” - The Irari Report team
Ira Winkler, CISSP President Secure Menem http://www.securementem.com/ @irawinkler https://twitter.com/irawinkler
Araceli Treu Gomes, Subject Matter Expert – Intelligence and Investigations, Dell SecureWorks @sleepdeficit_ https://twitter.com/sleepdeficit_
Creators of the Irari Report: @irarireport https://twitter.com/irarireport http://www.irarireport.com
REACTION:
Nothing really new or revolutionary here, but a good summary overview of what adversaries are and aren’t doing to perpetrate attacks, and what organizations are and aren’t doing to stop them. Key takeaways:
- Even most high-profile attacks really aren’t all that sophisticated, just persistent, adaptive, and opportunistic.
- Security needs to be adaptive.
- Assume you won’t achieve perfect prevention, so ensure you can backstop prevention with detection and response.
- The role of the human is vital; it’s not just a technology problem.
“Defense in Depth is Dead; Long Live Depth in Defense" - Matt Alderman
Matt Alderman ( @maldermania ) is VP of Strategy at Tenable Network Security.
REACTION:
I’m not convinced this is particularly valuable distinction. The title and terminology makes it sound more radical than it is. The real message appears to be simply that we need to more closely integrate and monitor our defenses, which is unquestionably a good point and a vital strategy.
Keynotes:
The conference planners definitely seem to front-load the most important and relevant keynote addresses in the early going. The later days' keynotes were in some cases of little direct relevance and in others were downright fanciful. There was only one talk on Thursday that I found to be of much practical value for our audience.
"Not Lost in Translation: Building an Architecture to Reshape Cybersecurity" - Pat Gelsinger, CEO, VMWare
Video: https://www.youtube.com/watch?v=2ZvWQKxru9k
Pat Gelsinger talked about the current information security landscape and pointed out some key facts:
- Disconnects between business leaders and technology leaders on
- the biggest risks facing their businesses (risk of a cyber breach doesn't even make many business leaders' top ten);
- the likelihood of suffering a serious breach (technology leaders rate it twice as likely as business leaders do).
- Security spending is going up while overall IT budgets stagnate or decline.
- Increased security spending is driving largely "organic" and uncoordinated growth in terms of security measures put in place; security controls are not being chosen and implemented as part of a well-planned architecture.
Gelsinger argues that the rise of virtualization presents an unprecedented opportunity to change the lack of a unified architecture. Because it sits underneath storage, computing, applications, and networking, the virtual layer provides a foundation for ubiquitous security. At the same time, the integration of cloud-based virtual servers means that companies have much of their infrastructure running on an untrusted network outside of their direct control. VMWare's new Distributed Network Encryption (DNE) offering allows for end-to-end authentication and encryption of network and application traffic within the virtual network, seamlessly including cloud-based and local servers.
Comments
Post a Comment