Chris thank you so yeah Chris my dinger
i'm here with security scorecard i was
out of the pwc event yesterday that we
won I'm myself been in security about 15
years 10 of those living in Germany in
every CCC since I don't want to admit
how long I think 21 c 3 high but that's
my first time speaking at a hacker
events this is kind of a kind of cool
when you go through what we do slightly
differently than i did yesterday for pwc
but i will give you a quick background
who we are I security scorecard we're
startup founded in 2013 by Alex am
polski and Sam cassimy they were the
seaso and head of compliance at gilt
groupe have any familiar an online
retailer I'm funded by sequoia GV I the
visions or the problem that we're
looking at and trying to solve is can we
instantly and non-intrusive lee measure
overall security risk for any company in
the world hi i'm in the primary use case
is third-party risk management vendor
supplier risk i'm sure most of you in
the room are familiar with say the
target hack they happen via a third
party air conditioner air conditioning
service company that's type of risk that
we're looking at I work with a number of
different global companies so I got a
few up here I'm primarily United States
a lot of financial services a lot of
health care but I want to jump right
into something more technical stuff so
the way we see the world is that you
know a lot of third a lot of breaches
particular you know data disclosure
breaches or resulting from third parties
in fact at this point most large
companies have good enough security
controls security programs that they're
not getting hacked nearly as much
through their own stuff as much as
through their third parties hi the way
we look at the world's your vendor risk
management controls often fail in
providing visibility into the third
party ecosystem for those of you that
work at vendors perhaps provide cloud
services preval gone through the exle
spreadsheet questionnaire do you change
your passwords very often do you patch
your systems
that entire yo sig sig light is OPC I
whatever you go through that's always
fundamentally a point in time assessment
the auditor or the customer says yes we
believe that on january first 2016 you
are secure now we have no idea about
january thirtieth or februari 28th or
moving down the 0 through time because
these third-party risk assessments are
typically always point in time they're
limited and there are subjective
essentially as a company aves a large
enterprise you're believing your
suppliers when they tell you that they
really do patch all the time and they
really do close security vulnerabilities
the approach we've taken is solving this
problem I got a couple of screenshots
from our platform up here I I'll run
I'll run through sort of how the
extremely skips to it music different
slide for this I'm the approach we've
taken to this problem is what I've got
up here so essentially we start at the
bottom collecting data so we have
various different data feeds our sink
our own sink holes or honey pots we look
at all of IP for space look at every TLS
server on the internet look at the
encryption settings for every TLS server
on the Internet look at every
certificates I look at mule malware c2
calling home scrape github for API keys
that have been mistakenly placed there
is great paste bin for passwords etc I'm
and put it all in a big data store
that's what we call threat market now
demo threat market versus a second in a
minute I'm in a separate process we
attribute the entire internet to who
which companies run that IP space so we
have we look at I'm obviously registry
data Erin ripe you know who is type
stuff bgp passive DNS I look at
certificates you know where the cns
point back to in order to create a
footprint for pretty much any company
currently monitor about a hundred
thousand companies I'm although I that's
just typically you know the ones we've
started looking at or some customers are
looking at we can automatically begin
monitoring new companies pretty much at
any time because we have this back-end
data I break that up into I've got these
grades / risk factor break the different
finding types up into different risk
factors and then weights companies
against each other we're not out saying
you have exactly six not five not seven
vulnerabilities we're saying of the
types of data we can observe looking at
your TLS settings looking at the open
ports on your network looking at the
malware that we see calling home from
your network how our house secure is one
company comparatively to another and put
that in essentially I know what our
American school grades A through F
Germany be 1 through 6 i'm not sure what
it is here I in order to give vendor
risk managers a fairly easy comparison
I'm in order to understand how secure
one company is versus another and that
boils into the platform so I've got the
names obscured to protect the guilty hi
of which companies these are but
essentially there's a portfolio of
companies each with a different security
rating each of which is broken down if
you click into the company into those 10
factors and then I like the second view
the bottom right here of the overall
portfolio grades and so you can see of
all of my vendors which companies have
which types of security issues what's
the most common issue which companies
have been decreasing so which companies
have gone from a high to a low grade in
the last seven days that might indicate
that it breaches imminent or it might
indicate they just quit funding their
security team or fired them all I
haven't aren't patching in which case as
a large enterprise you may want to
rethink your relationship to that
company I'm so it will happen just for a
second because this is a technical
conference and this takes a minute for
this to flip high into some of the
back-end data just to show you sort of
what we've got because the one use case
is pure vendor risk and that's the sort
of fun time I was showing you here the
other use case for this back-end threat
market data is I'm penetration testing
auditing you were talking to Price
Waterhouse yesterday you know a lot of
the stuff that we have in this store
just available at any time is sort of
the first early steps of a pen test or
you know the scoping discovery
reconnaissance I for an audit pen test
whatever I'm and so we built this big
data store would just have all this data
I'm don't lock on these accounts
I'm if you would I I don't know who
cares I am minutes perfect just couple
in a couple examples I just coming up
just three minutes ago I just hit a post
Lu into the banner grabs we maintain a
store of banner grabs from across the
Internet I am so we've got you know
various different patchy types and GI NX
hi different data different ports we can
search all this by whatever port and
look if there's any else to port 23 at
Oracle and so this is this is leveraging
the fact that we've attributed a
different parts of the internets two
different companies and so we can go
very quickly and figure out where does
Oracle have tell Matt running a semantic
Raptor firewall wow what is that thing
even get updates anymore I'm all right
into this is the type of data that can
be used it feeds the actual product but
it can equally well be used for auditing
pen testing lots of different ethical
stuff I am another example just looking
at leaked passwords we scrape I paste
bin number different sleek sites in
order to find I password dumps and we
save those then again we attribute them
versus the high versus the company in
order to arrive at score cards like this
one so this is I'm not going to learn a
lot of depth this is the current Cisco
scorecard i have got a 76 percent and
we've had in the last 90 days discovered
two different passwords or at risk
bubble this up again we're not saying
that cisco is good or bad for having two
passwords leaked we're making imperative
assessment how many cisco passwords are
out there versus juniper versus Palo
Alto whatever else thank you very much
you