Embed Size (px)
DESCRIPTION
In the wake of the disclosure of the Heartbleed OpenSSL vulnerability in April, your company’s security strategy may have skipped a beat. Join us to learn more about the ramifications and recovery from Heartbleed as experts from IBM X-Force share findings from the latest IBM X-Force Threat Intelligence Quarterly 3Q report. Join the webinar to learn more about: - The Immediate Aftermath of Heartbleed: Just one day after the disclosure, IBM Managed Security Services (MSS) witnessed attacks on customer networks spiking to 300,000 attacks in a 24-hour period. Find out why, despite a patch being issued, attacks are still ongoing. - One-Day Attacks: For one-day attacks, the goal of the attacker is to take advantage of the exposure window of organizations between when the patches are announced and when the patches are actually deployed. Learn what steps you can take to prepare your network. - Declining Vulnerability Disclosures: Vulnerability disclosures in the first half of 2014 are down compared to prior years. For those that were reported, like Heartbleed, the current CVSS v2 standard doesn’t necessarily reflect the actual risk the vulnerability may pose. Learn how the industry is adapting to assess these risks more accurately. View the full on-demand webcast: https://www2.gotomeeting.com/register/319495890
Citation preview
© 2012 IBM Corporation
IBM Security Systems
1© 2014 IBM Corporation
Open Heart Security: Reconstructing Your Protection StrategyMichael HamelinLead X-Force Security Architect
© 2013 IBM Corporation
IBM Security Systems
IBM X-Forceis the foundation for advanced security and threat research across the IBM Security Framework.
© 2013 IBM Corporation
IBM Security Systems
IBM X-Force® Research and Development
VulnerabilityProtection
IPReputation
Anti-Spam
MalwareAnalysis
WebApplication
Control
URL / WebFiltering
The IBM X-Force Mission Monitor and evaluate the rapidly changing threat landscape Research new attack techniques and develop protection for tomorrow’s security challenges Educate our customers and the general public Integrate and distribute Threat Protection and Intelligence to make IBM solutions smarter
Expert analysis and data sharing on the global threat landscape
Zero-dayResearch
© 2013 IBM Corporation
IBM Security Systems
Coverage20,000+ devices
under contract
15B+ events managed per day
133 monitored countries (MSS)
1,000+ security related patents
100M+ customers protected from
fraudulent transactions
Depth23B analyzed web pages & images
7M spam & phishing attacks daily
81K documented vulnerabilities
860K malicious IP addresses
Millions of unique malware samples
IBM X-Force monitors and analyzes the changing threat landscape.
© 2014 IBM Corporation
IBM Security Systems
5
More than
half a billion recordsof personally identifiable information (PII) were leaked in 2013.
© 2014 IBM Corporation
IBM Security Systems
6
In April 2014, the Heartbleed vulnerability in the OpenSSL software library was disclosed.
The bug is in the OpenSSL's implementation of the TLS/DTLS (transport layer security protocols) heartbeat extension (RFC6520), which could allow for the exfiltration of passwords, PII, and SSL certificate private keys.
Source: What to Do to Protect against Heartbleed OpenSSL Vulnerability”, SecurityIntelligence.com
© 2014 IBM Corporation
IBM Security Systems
7
Heartbleed attacks surged after the vulnerability disclosure.
After Heartbleed was disclosed, IBM MSS witnessed over 300,000 attacks in 24 hrs, with an average of 3.47 attacks per second across the customer base.
© 2014 IBM Corporation
IBM Security Systems
8
MSS continues to average 7k attacks per day – mostly from malicious hosts.
© 2014 IBM Corporation
IBM Security Systems
9
Rather than a single IP address executing the attack repeatedly, many of the attacks used a distributed method.
This enabled attackers to have a large, diversified attack surface and the flexibility to overcome rudimentary blocking strategies.
© 2014 IBM Corporation
IBM Security Systems
10
One-day attack methods demonstrate how quickly attackers rush to exploit a vulnerability like Heartbleed.
1-Day Attacks are those that rush to exploit a new vulnerability immediately after it is publically disclosed.
© 2014 IBM Corporation
IBM Security Systems
11
X-Force noted this trend was similar to a 2012 disclosure of a Java vulnerability.
© 2014 IBM Corporation
IBM Security Systems
12
There was a decline in vulnerability disclosures in the first half of 2014; this could be the first reduction since 2011.
© 2014 IBM Corporation
IBM Security Systems
13
It is difficult to point to any one factor that has contributed to the decline in the number of vulnerability disclosures in 2014.
A decreasing number of vendors consistently reporting vulnerabilities might be contributing to the recent decline in total overall vulnerabilities disclosed.
© 2014 IBM Corporation
IBM Security Systems
14
Plug-ins are responsible for 90% of total CMS vulnerabilities disclosed. This heightened risk leads to mass infection.
© 2014 IBM Corporation
IBM Security Systems
15
Does current CVSS scoring represent actual risk to networks and systems?
Heartbleed existed for two years and received a CVSS medium base score of 5.0.
© 2014 IBM Corporation
IBM Security Systems
16
What can you do to mitigate these threats?
Keep up with threat intelligence.
Maintain a current and accurate asset inventory.
Have a patching solution that covers your entire infrastructure.
Implement mitigating controls.
Instrument your environment with effective detection.
Create and practice a broad incident response plan.
© 2014 IBM Corporation
IBM Security Systems
17
Connect with IBM X-Force Research & Development
IBM X-Force Security Insights blog at www.SecurityIntelligence.com/topics/x-force
Follow us at @ibmsecurity and @ibmxforce
Download IBM X-Force Threat Intelligence Quarterly Reports
http://www.ibm.com/security/xforce/
© 2014 IBM Corporation
IBM Security Systems
18
FREE Seminar & Hands-on Workshop:
ibm.com/security/xforceJoin us to get answers to critical security concerns, including the most critical ongoing event of the year, the Heartbleed vulnerability, and to meet IBM X-Force & Security experts.
Following lunch, complimentary hands-on Incident Forensics Workshop!!
Cities/Dates:
10/8 – Chicago
10/9 – Philly
10/23 - Miami/Hollywood
11/12 – Boston/Waltham
11/20 – Seattle
© 2014 IBM Corporation
IBM Security Systems
19
www.ibm.com/security
© Copyright IBM Corporation 2013. All rights reserved. The information contained in these materials is provided for informational purposes only, and is provided AS IS without warranty of any kind, express or implied. IBM shall not be responsible for any damages arising out of the use of, or otherwise related to, these materials. Nothing contained in these materials is intended to, nor shall have the effect of, creating any warranties or representations from IBM or its suppliers or licensors, or altering the terms and conditions of the applicable license agreement governing the use of IBM software. References in these materials to IBM products, programs, or services do not imply that they will be available in all countries in which IBM operates. Product release dates and/or capabilities referenced in these materials may change at any time at IBM’s sole discretion based on market opportunities or other factors, and are not intended to be a commitment to future product or feature availability in any way. IBM, the IBM logo, and other IBM products and services are trademarks of the International Business Machines Corporation, in the United States, other countries or both. Other company, product, or service names may be trademarks or service marks of others.
Statement of Good Security Practices: IT system security involves protecting systems and information through prevention, detection and response to improper access from within and outside your enterprise. Improper access can result in information being altered, destroyed or misappropriated or can result in damage to or misuse of your systems, including to attack others. No IT system or product should be considered completely secure and no single product or security measure can be completely effective in preventing improper access. IBM systems and products are designed to be part of a comprehensive security approach, which will necessarily involve additional operational procedures, and may require other systems, products or services to be most effective. IBM DOES NOT WARRANT THAT SYSTEMS AND PRODUCTS ARE IMMUNE FROM THE MALICIOUS OR ILLEGAL CONDUCT OF ANY PARTY.
www.ibm.com/security
© Copyright IBM Corporation 2014. All rights reserved. The information contained in these materials is provided for informational purposes only, and is provided AS IS without warranty of any kind, express or implied. IBM shall not be responsible for any damages arising out of the use of, or otherwise related to, these materials. Nothing contained in these materials is intended to, nor shall have the effect of, creating any warranties or representations from IBM or its suppliers or licensors, or altering the terms and conditions of the applicable license agreement governing the use of IBM software. References in these materials to IBM products, programs, or services do not imply that they will be available in all countries in which IBM operates. Product release dates and/or capabilities referenced in these materials may change at any time at IBM’s sole discretion based on market opportunities or other factors, and are not intended to be a commitment to future product or feature availability in any way. IBM, the IBM logo, and other IBM products and services are trademarks of the International Business Machines Corporation, in the United States, other countries or both. Other company, product, or service names may be trademarks or service marks of others.
Statement of Good Security Practices: IT system security involves protecting systems and information through prevention, detection and response to improper access from within and outside your enterprise. Improper access can result in information being altered, destroyed or misappropriated or can result in damage to or misuse of your systems, including to attack others. No IT system or product should be considered completely secure and no single product or security measure can be completely effective in preventing improper access. IBM systems and products are designed to be part of a comprehensive security approach, which will necessarily involve additional operational procedures, and may require other systems, products or services to be most effective. IBM DOES NOT WARRANT THAT SYSTEMS AND PRODUCTS ARE IMMUNE FROM THE MALICIOUS OR ILLEGAL CONDUCT OF ANY PARTY.
