�ݺ�ߣ

Editor's Notes

• #13: These aren’t the only attack paths. For example you could attack upstream i.e.: Third party software components source repos. Customer threat actors could go after the service’s corporate IT etc.
• #24: Packaging, testing & deployment Careful trust and architecture boundary considerations Kill passwords forever (2FA/MFA) Ability to easily monitor to varying degrees (live, log or full packet capture) Ability to easily isolate aspects while maintaining service Ability to easily operate while isolated from known compromised / good
• #25: Ability to roll credentials / secrets Ability to query service properties, behaviour, performance etc. Ability to increase protective monitoring / active response Ability to verify integrity* (configuration, software, package, system, host, network etc..) Ability to increase integrity verification frequency
• #26: Ability to define, model or learn healthy / normal Ability to define and execute reactions to events / situations if this then that Consider (less tried and tested – or ‘it worked in PhD project’) Machine learning for behaviours at all layers (we’ve seen this productized in a focused manner) Ability to rate or access limit functionality automatically and/or manually in high alert situations Something we’ve not considered
• #27: Educate in defensive coding and functional design Consider 3rd party component integrity verification Ability to verify source control integrity Ability to verify build server integrity Ability to verify development to live assets integrity Archive releases (artefacts, source, test output and logs) Develop compromise unit test cases for functionality in systems and software Test compromise scenarios in pre-production
• #28: Able to define ‘security healthy’ Plan for highest level of access compromise Ensure configuration management Ensure configuration integrity monitoring Protective monitoring and anomaly detection Have the ability to time-line across many distinct sources of data Take inspiration* from Netflix’s Simian Army and fire drill investigating, segregating, operating, rebuilding, repairing, rolling and reintegrating
• #30: You need to be able to define system, network, host, software and service
• #31: Integrity verification or other high confidence indicator Ability to identify likely root cause and remediate* Alert (operations) Opt out of operation Snapshot (machines / configuration / logs) Revert (to known good) Restart Verify Reintegrate
• #32: Client’s user behaviour – needs to be learnt Client’s software behaviour – do we care? Clients system behaviour – do we care? Client behaviour – needs to be learnt
• #33: Service behaviour – needs to be defined / modelled / learnt Software behaviour – needs to be defined / modelled / learnt System behaviour – needs to be defined / modelled / learnt Network behaviour – needs to be defined / modelled / learnt Operations / staff (and their credentials) behaviour
• #35: Client’s database queries usually*(1) non sequential across records and non complete result sets*(2) Query observed doing select * from what is usually a source(*3) of the same base 75 queries Results return speed is rate limited*(4) with marginal effect Alert is raised to client security point of contact query, source, destination (including db and table), time and date reaction by system Snapshot database logs and source machinetaken into security incident zone for client / your analysis … facilitates full post incident analysis
• #36: An operations desktop gets rolled by client side Credentials stolen and used at a higher rate*(1) than normal during non incident window*(2) or against systems not part of incident group*(3) Credentials used from hosts other than expected*(4) Alert sent to operations shift manager and security operations centre sources, destination, times and dates reaction by system Credentials automatically disabled … exposure window minutes
• #37: One large company has Red and Blue teams Red always attacking the services Blue always looking trying to detect and mitigate Idea: Your Red team could be a Netflix-esq simian army Your Blue team could be your self-healing systems Result = If stuff isn’t happening then it’s broken!
• #38: Services, systems and software need to be compromise ready – old school: Secure engineering Intrusion prevention Principal of least privilege Segregation Intrusion detection Current approaches revolve around: Event correlation / confidence indicators Human analysis and intervention Machine learning Modelling … it’s the way of the future …