Threat Detection - Cyberangriffe frühzeitig erkennen und eindämmen! Wolfgang Kiener Business Development Manager

Transkript

1 Threat Detection - Cyberangriffe frühzeitig erkennen und eindämmen! Wolfgang Kiener Business Development Manager

2 Umsatz Mio. Deutschland/international (in Millionen ) Nach Geschäftsbereichen (in %) DEUTSCHLAND 963 INTERNATIONAL Produkte Industrie Service Mobilität Academy & Life Care Systeme ICT & Business Solution Konsolidierte Daten (gemäß IFRS) Unkonsolidierte Daten Corporate Präsentation 2018

3 ICT & Business Solutions Von der strategischen Beratung über Konzeption und Prozessoptimierung bis zu Implementierung, Betrieb oder Zertifizierung der Systeme Corporate Präsentation 2018

4 ICT & Business Solutions Eckdaten 139 Mio. Umsatz 6% des Gesamtumsatzes 600 Spezialisten GESCHÄFTSFELDER IT-Services & Cyber Security Telco Solutions & Consulting SCHWERPUNKTBRANCHEN Telekommunikation Finanzdienstleistungen Energie Handel Gesundheit Fertigung Mobilität, Logistik, Automobil Luft- und Raumfahrt WISSENSWERTES Seit 2014 sind wir am deutschen Markt der führende unabhängige Anbieter von IT- und Internetsicherheitsleistungen und gehören weltweit zu den führenden Akteuren Wir beraten Netzwerkbetreiber bei der Planung, beim Aufbau und bei der Pflege ihrer Telekommunikationsinfrastrukturen kompetent technologieorientiert kosteneffizient Stand 2017: Unkonsolidierte Daten Corporate Präsentation 2018

5 TÜV Rheinland i-sec. Informations- und IT-Sicherheit. Führender unabhängiger Dienstleister für Informationssicherheit in Deutschland Beratungs- und Lösungskompetenz in ganzheitlicher Informationssicherheit von der Steuerungsebene bis ins Rechenzentrum inkl. betriebsunterstützender Leistungen Exzellente Technologie-Expertise, umfassendes Branchen-Knowhow, Partnerschaften mit Marktführern International zählen wir im Verbund mit unseren Schwestergesellschaften OpenSky und 2MC zu den wichtigsten unabhängigen Anbietern Zertifiziert nach ISO und ISO ICT & Business Solutions

6 TÜV Rheinland i-sec GmbH. Fakten und Zahlen. Standorte Deutschland Köln (HQ) München Gelnhausen Saarbrücken Hannover Hamburg 15 Sales Fachliches Kompetenzteam 20 Security Engineering 60 Management Beratung 45 Professional Service und Betrieb Kernbranchen und Sitz unserer Kunden Finanzen Automobil Energiewirtschaft Chemie/Pharma Telekommunikation Int. Mischkonzerne Transport/Logistik Öffentlicher Dienst Handel! Projekteinsatz an Tagen in ICT & Business Solutions

7 Digital Enterprise. Protected. Ein umfassendes, globales Serviceportfolio zum Schutz digitaler Unternehmen. Portfolio Kategorien: Service Lines: Service Typen: Mastering Risk & Compliance Governance & Strategy Risk & Compliance Management Information Security Management Systems Business Continuity Management Data Privacy Advanced Cyber Defenses Identity & Access Management Consulting Network Security Services Application Security Endpoint Security Testing Services IoT Security Managed Industrial Services Security Security Analytics & Detection Incident Response Consulting Services Testing Services Managed Services Data Protection Secure Cloud Adoption Cloud Security Enterprise Cloud Adoption Hybrid Infrastructure TÜV Rheinland

8 Referent WOLFGANG KIENER Business Development Manager TÜV Rheinland - Cybersecurity Wolfgang.Kiener@i-sec.tuv.com 8

9 % where days or less Status Quo: Threat Detection and Response COST AND TIME FOR REMEDIATION IS HIGH AND RISING 2 DEFENDERS LOSING THE INNOVATION BATTLE % ATTACKER % 50% 67% 56% 55% 61% 67% 62% 67% 89% 62% 76% 62% 84% CYBER- DEFENSE GAP Minimum Mean Mediana Maximum 25% DEFENDERS MTTI MTTC 0% : On average, it took respondents 242 days to spot a breach caused by a malicious attacker, and further 99 days to contain it. Average total cost of a data breach Average cost per stolen record Cost increase per record $4,31 Mio. $225 25% 1 Verizon DBIR Ponemon Institute

10 Reducing time to detect and contain incidents Opportunities for improvement! Big Data Analytics Emerging Technologies Enhanced Use of Threat Intelligence Visibility into IoT & OT Risk-Aligned Threat Detection Real-time security insights across the large and growing data of the modern enterprise Machine learning and behavior anomaly detection beyond traditional event correlation Integration of threat intelligence correlation across data sources Behavior based analytics for Internetof-Things and Operational Technology Focus detection on top risks, accelerate investigation and response, and report on capabilities and operational metrics 10

11 Digitalisation is Progressing. Unstoppable. Risks develop exponential as well. INDUSTRY 4.0 2,631,684 $ 951,000,000 The Great Train Robbery, 1963 Bangladesh Bank/ Swift Heist, 2016 Automation Scalability and Interconnectivity AI and Machine Learning Agility CYBER RISK 4.0 Risk Gap Attack automation AI and Machine Learning Attackers are agile Complexity increases attack surface Vulnerabilities are hardly to avoid Technical Development Know-How Cyber Risk = Business Risk 11

12 Risk-aligned threat detection approach 1 Identify top risks 2 Define related attack scenarios 3 Map threat activities Top Cyber Risks Industry Risk Profiles Enterprise Risk Register 4 Develop Analytics 5 Monitor, Investigate & Respond 6 Capture Metrics & Inform GRC 12

13 Risk Prioritization Many ways to prioritize risk this example uses a scoring method and considers controls and residual risk Impact Likelihood Inherent Risk Controls Reduction Residual Risk Risk Statement Confidentiality 1 Treat Means 4 Integrity 4 Availability 1 Safety Treat Motive 1 Threat Opportunity Risk Statement Confidentiality 4 Treat Means 4 Integrity 1 Availability 1 Safety Treat Motive 4 Threat Opportunity

14 Define threat activities by attack phase for the selected attack scenario Models available to assist Cyber Kill Chain CIS Community Attack Model MITRE ATT&CK Cyber Threat Framework Reconnaissance Initial Recon Persistence Preparation Weaponization Acquire/Develop Tools Privilege Escalation Engagement Delivery Delivery Defense Evasion Presence Exploitation Initial Compromise Credential Access Effect/Consequence Installation Misuse/Escalate Privileges Discovery Command & Control Internal Recon Lateral Movement Actions on Objectives Lateral Movement Execution Establish Persistence Collection Execute Mission Objectives Exfiltration Command & Control 15

15 Unfetter NSA tool that utilizes ATT&CK 16

16 Develop and documenting threat analytics Threat activity Analytic name Analytic description Key risk indicator Data sources Required data Analytics (platform specific) Threat detection guidance Notes Map to risk statements Author Date EXAMPLE: THREAT ACTIVITY LOGIN WITH COMPROMISED CREDENTIALS (EXPLOIT PHASE) 18

17 Risk-Aligned Threat Detection Information Security Compliance BCM ISMS Metrics & Reporting Risk Management GRC Cyber Security Requirements Risks! Incident Management! Reports Metrics Trends Trend/ History SOC IT-Security Log Data Security Relevant Informationen Security Intelligence! Relevant Deviations Flow Data Sensors 19

18 Conclusion Benefits of risk-aligned threat detection Better focus on threat activity that matters most to the organization More context and clarity about detected threat events Opportunities to automate investigation and response activities Improved risk management program Reduced time to detect and contain incidents 20

19 TÜV Rheinland. Who are we? Protecting society since 1872 $2.3 Billion Privately Held 144 Years Old 500 Locations 69 Countries Industry 1.0 Industry 2.0 Industry 3.0 Industry ,320 people Mechanical Production Mass Production & Electricity Electronic & IT Systems Cyber-physical Systems, Social, Mobile, Analytics, Cloud! The digital transformation will be defined by the use of cyber-physical systems. 21

20 TÜV Rheinland ICT & Business Solutions. Cybersecurity. HQ s Cologne / Boston / London 68 Mio. Revenue Security Experts Core Industries Finance, Automotive Chemie & Pharma, Energy, Telecommunication Regions Germany, USA, UK, Golf Region, APAC as Growth Case 22

21 Vielen Dank! Wolfgang Kiener Business Development Manager Cybersecurity