Day 1 – Tues June 11 2013:
10:55am – “Information security adaptation: Survival in an evolving threat landscape”, Carl Herberger, VP of security solutions, Radware
This presentation (I couldn’t find his exact slides, but I found this alternate copy from this location) provided a great overview of the current threat landscape. The presentation offered great statistics pertaining to brands that have been affected by outages over the last 18 months. Vendors include such names as Best Buy, Apple, Walmart, AT&T, KPMG and numerous other large global brands. Carl’s key message: nobody is immune.
Carl also shared some stories pertaining to threats, including a story about Anonymous intervening in a property dispute in Philadelphia.
Common cloud targets right now include:
- DNS
- ISPs
- CDNs
- CA/CRL
If you look at the “security trinity”:
- Confidentiality
- Integrity
- Availability
Out of the three, availability is the toughest to deal with right now as it is the avenue being exploited by many attackers today.
ddoswarriors.com (aka security.radware.com) offer some great insight and tutorials into this area.
Carl highlighted some of the various weaknesses that DOS attacks target right now. He referred to these by calling them “Gartner Sep 2012: Anti-DoS “BlindSpot””. I couldn’t find the Gartner reference online anywhere, but the slides were compelling in that they showed tools (firewalls, CDNs, etc.) and the attack types that were vectored against the various tools (vulnerability exploits, network flood, etc.). Very informative summary!
Carl ended with a very compelling (and creative) way of viewing today’s threat landscape. He explained the concept of the Zombie House. The house has thick concrete walls that completely envelop the house in the event of a Zombie attack. Carl suggested that we wouldn’t be happy if the concrete only closed 80% of the way, as this would still leave the occupants vulnerable. Similarly, we can’t be satisfied with 80% protection from current threats, otherwise, we remain vulnerable to attack.
Overall, this was a fantastic presentation with plenty of great material.
Todd H Dow 