Japan Computer
Emergency Response
Team Coordination
Center

電子署名者 : Japan Computer Emergency
Response Team Coordination Center
DN : c=JP, st=Tokyo, l=Chiyoda-ku,
email=office@jpcert.or.jp, o=Japan Computer
Emergency Response Team Coordination
Center, cn=Japan Computer Emergency
Response Team Coordination Center
日付 : 2013.02.18 11:10:01 +09'00'

Evidence Based Risk Management

When analysis is used to uncover how sensitive data is stolen fromorganizations, who’s doing it, why they’re doing it, and what might be done
to prevent it
Seán Paul McGurkJanuary 24, 2013
Confidential and proprietary materials for authorized Verizon personnel and outside agencies only. Use, disclosure or distribution of this material is not permitted to any unauthorized persons or third parties except by written agreement.

The RISK Team
More than an acronym

Research

Uncover the who, what, when, how and why behind computer
security incidents.

Investigations

Study and understand the ever-changing risk and threat
environment. It all starts here.

Solutions

Leverage lessons learned from “R” and “I” to create new
products and enhance our existing portfolio.

Knowledge

Cultivate and disseminate our information resources to makeour people, products, and brand smarter than the competition.

The RISK Team = Risk Intel + Investigative Response + eDiscovery
Confidential and proprietary materials for authorized Verizon personnel and outside agencies only. Use, disclosure or distribution of this material is not permitted to any unauthorized persons or third parties except by written agreement.

2RISK Team Overview(Research, Investigations, Solutions, Knowledge)

Approach: IT Investigative focus
Diverse Investigator Backgrounds
Licensed Private Investigators
Truly Global Coverage – 24x7x365•Investigators based in 16 countries•

Forensic labs and evidence storage facilities

Service offerings:– IT Investigative Support (On-demand)– Guaranteed Response (Retainer-based)– eDiscovery and Litigation Support– PCI Forensic Investigations– Electronic Data Recovery / Destruction– Incident Response Training– Mock-Incident Exercises– Corporate IR Program Developmentin Americas, Europe, and Asia-Pacific

No Subcontractors
Global PFI Firm
Annual Data Breach Investigations Report

Verizon RISK team has
handled 8 of the world’s 10 largest
data compromise investigations! **Source: http://www.idtheftcenter.com/
Confidential and proprietary materials for authorized Verizon personnel and outside agencies only. Use, disclosure or distribution of this material is not permitted to any unauthorized persons or third parties except by written agreement.

3

RISK Team Global Reach

Confidential and proprietary materials for authorized Verizon personnel and outside agencies only. Use, disclosure or distribution of this material is not permitted to any unauthorized persons or third parties except by written agreement.

4

Seven Sources of Threat Intelligence

1Threat & Vulnerability Intel
Track and analyze new software vulnerabilities and related attacks

2Underground Intel
Watch discussions, code sharing, planning,... Historically BBS, then Usenet, now more IRC and Cons...

3ICSA Labs Intel
Security product testing and security consortia operations. 400+ products

4Forensics Intel
Data and Intel from forensics investigations (200+ cases per year).

5MSS Intel
Data from IDS, FW, IPS, Applications…

6

Management & Monitoring SOC operations

Net Intel
Data from backbone. Sensors on more than 1 Million VzB addresses. Netflow Honey nets, Honey Pots…

7Studies & Surveys
VZB Studies, surveys (10+/yr), Others published data to drive Risk Models, equations & methodology

Confidential and proprietary materials for authorized Verizon personnel and outside agencies only. Use, disclosure or distribution of this material is not permitted to any unauthorized persons or third parties except by written agreement.

5Knowledge improves operations

Confidential and proprietary materials for authorized Verizon personnel and outside agencies only. Use, disclosure or distribution of this material is not permitted to any unauthorized persons or third parties except by written agreement.

6Cyber Threat Environment• Malicious cyber activity is routinely directed at the U.S.
Government, private sector, and academia– Growing more sophisticated, targeted, and prevalent– Nature and source of the threat is diverse– Designed to• Exploit data gathered from information systems or networks (computernetwork exploitation)• Disrupt, deny, degrade, or destroy information resident in computersand computer networks or the computers and networks themselves(computer network attack)• We have insight on intrusions into private sector networks, but arebecoming more aware of U.S. information infrastructure
vulnerabilities to cyber attacks– Key factors: dynamic business environment, reliance on open systems
and COTS, management/enterprise networks’ Internet connections– Key challenges: Your sensitive data isn’t just on your network, it is on
your vendors networks, consultants networks, suppliers networks, etc.
Confidential and proprietary materials for authorized Verizon personnel and outside agencies only. Use, disclosure or distribution of this material is not permitted to any unauthorized persons or third parties except by written agreement.

7

Cyber Security Consequences• The Intelligence Community has information from multiple sources ofcyber intrusions followed by extortion demands• Encrypting corporate data/demanding money to decrypt the data
• Theft of sensitive corporate data
• Industrial espionage costs US businesses up to $250 billion peryear• 98% of breaches were attributed to external agents• Theft of personal data
• Attacker/there is typically motivated by profits (value isapproximately $8 per record)• 855 investigated incidents with over 174 million records
compromised• Cyber attacks have been used to disrupt critical services in several
regions outside the U.S.
Confidential and proprietary materials for authorized Verizon personnel and outside agencies only. Use, disclosure or distribution of this material is not permitted to any unauthorized persons or third parties except by written agreement.

8

Cyber Threat Vectors
Threat Level 1“Garden Variety”

Threat Level 2“Mercenary”• Inexperienced• Limited funding• Opportunistic behavior• Target known vulnerabilities• Use viruses, worms,
rudimentary trojans, bots
• Acting for thrills, bragging
rights• Easily detected• Higher-order skills• Well-financed• Targeted activity• Target known vulnerabilities• Use viruses, worms, trojans, bots asmeans to introduce more sophisticatedtools• Target and exploit valuable data
• Detectable, but hard to attribute

Threat Level 3“Nation State”• Very sophisticated tradecraft• Foreign intel agencies• Very well financed• Target technology as well as info
• Use wide range of tradecraft• Establish covert presence on
sensitive networks• Difficult to detect• Supply Interdiction/hardware
implants

Confidential and proprietary materials for authorized Verizon personnel and outside agencies only. Use, disclosure or distribution of this material is not permitted to any unauthorized persons or third parties except by written agreement.

9

2012 DBIR Contributors

8 years of investigations and research
2000+ confirmed data breach cases
More than 1 billion stolen records
Confidential and proprietary materials for authorized Verizon personnel and outside agencies only. Use, disclosure or distribution of this material is not permitted to any unauthorized persons or third parties except by written agreement.

10Confidential and proprietary materials for authorized Verizon personnel and outside agencies only. Use, disclosure or distribution of this material is not permitted to any unauthorized persons or third parties except by written agreement.

11

Confidential and proprietary materials for authorized Verizon personnel and outside agencies only. Use, disclosure or distribution of this material is not permitted to any unauthorized persons or third parties except by written agreement.

12Threat Agents

Confidential and proprietary materials for authorized Verizon personnel and outside agencies only. Use, disclosure or distribution of this material is not permitted to any unauthorized persons or third parties except by written agreement.

13

Threat Agents: External

Confidential and proprietary materials for authorized Verizon personnel and outside agencies only. Use, disclosure or distribution of this material is not permitted to any unauthorized persons or third parties except by written agreement.

14

Threat Actions

Confidential and proprietary materials for authorized Verizon personnel and outside agencies only. Use, disclosure or distribution of this material is not permitted to any unauthorized persons or third parties except by written agreement.

15

Top Threat Actions

Confidential and proprietary materials for authorized Verizon personnel and outside agencies only. Use, disclosure or distribution of this material is not permitted to any unauthorized persons or third parties except by written agreement.

16

Top Threat Actions: Larger Orgs

Confidential and proprietary materials for authorized Verizon personnel and outside agencies only. Use, disclosure or distribution of this material is not permitted to any unauthorized persons or third parties except by written agreement.

17Compromised Assets

Confidential and proprietary materials for authorized Verizon personnel and outside agencies only. Use, disclosure or distribution of this material is not permitted to any unauthorized persons or third parties except by written agreement.

18

Compromised Data

Confidential and proprietary materials for authorized Verizon personnel and outside agencies only. Use, disclosure or distribution of this material is not permitted to any unauthorized persons or third parties except by written agreement.

19

Timespan of events

Confidential and proprietary materials for authorized Verizon personnel and outside agencies only. Use, disclosure or distribution of this material is not permitted to any unauthorized persons or third parties except by written agreement.

20

Breach Discovery

Confidential and proprietary materials for authorized Verizon personnel and outside agencies only. Use, disclosure or distribution of this material is not permitted to any unauthorized persons or third parties except by written agreement.

21

Breach Discovery

Confidential and proprietary materials for authorized Verizon personnel and outside agencies only. Use, disclosure or distribution of this material is not permitted to any unauthorized persons or third parties except by written agreement.

22Collective Intelligence Framework

VERIS metrics
Inference signatures
Watchlist IP addresses
Malcode hash patterns
Text strings
Breach notifications
Attribution tables
Artifacts or Indicators (IOCs)

Collective Intelligence
Framework (CIF)

RISK Team
Investigations, Research

VerizonBackbone, VzW, Terremark,Vz Federal, Internal security

Trusted Sources
DHS, Intelligence and Law
Enforcement Communities

Other 3rd parties
VERIS Community, ISACs,OSINT

Confidential and proprietary materials for authorized Verizon personnel and outside agencies only. Use, disclosure or distribution of this material is not permitted to any unauthorized persons or third parties except by written agreement.

23

24
Confidential and proprietary materials for authorized Verizon personnel and outside agencies only. Use, disclosure or distribution of this material is not permitted to any unauthorized persons or third parties except by written agreement.

24