Agenda

Sometimes just having a SOC isn’t enough to address insider threat issues. Security operations teams are managing massive amounts of data across billions of events from on premises to the cloud. Looking for specific needles like insider threats in this complex haystack has special requirements that encompass both searching historic data and seeing evolving credential behavior changes as they happen.

Whether from downsizing or expanding the business, employees, vendors, contractors, and more are moving in and out of your environment. And often, it is during turbulent times that insider threats go unobserved as everything  changes so quickly. Insider threat initiatives require a new, more focused approach.

This presentation will explore:

• The common scenarios that indicate you need an insider threat team, how to build a mission statement, and tools

• Four attributes of a successful insider threat program
• How behavioral analytics baseline “normal” behavior of users and devices – showing risk faster
• An automated investigation experience that replaces manual routines and effectively guides new insider threat teams

Purpose-built IoT, OT, and network devices that are connected and disallow the installation of EDR software are part of a massive, rapidly growing category of targets that nefarious actors are exploiting. Attackers can use them to evade detection and maintain persistence. Nation-states, cybercriminals, and insiders have discovered that these devices can be easily compromised and used for a wide variety of malicious purposes.

Countries like Russia have developed tools like Fronton that are specifically designed to attack and control these device types. Some common devices from countries like China have even been banned because they ship with malware preinstalled from the manufacturer.

We’ve been researching IoT, OT and network device security for over five years across millions of devices and hundreds of organizations worldwide. This is unique research that isn’t being conducted by any other organization at this scale. This presentation will share several discoveries across device visibility, vulnerabilities, and exploits. The research calls out the most exploited device types, explores multiple war stories, and illustrates methods to mitigate the risks.

These purpose-built devices are being turned against us and becoming a new cybersecurity frontline across the enterprise, smart cities, buildings, and ships, healthcare providers, manufacturing, defense, our homes, and more. Compromises are impacting the physical world by unlocking our doors, shutting down power, and spying with audio and video surveillance. Attackers can use these devices to mine cryptocurrency, conduct DDoS attacks, and engage in ransomware as well as and move laterally to compromise our IT and cloud-based assets.

We don’t know what devices we have, so we don’t know what to fix. Even if we knew what to fix, it would be impossible to do so manually because of the scale. If we did fix it, we don’t have anything in place to ensure things stay fixed. This is leaving our IoT, OT and network devices at risk along with IT and cloud-based assets. These are our devices, and it’s time to take back control from the attackers.