thank you everyone for joining this 3:15
session and source Boston a lot of
familiar faces thank you I think a lot
of you know Bob Bob Brutus has been in
InfoSec industry for many many years he
told me not to read this whole long bio
here which really the guy's wicked smaht
right put my Boston accent on so listen
to what he has to say Bob do you prefer
questions I will be getting questions
okay great so feel free to interrupt him
and we're here to yeah so be as
interactive as you want to with this one
I've got some basic set up stuff about
some of the cool new things we've done
with the dir but if you have questions
do not hesitate to throw them on I may
not have a slider a graphic I can throw
up I do have the report handy I can
bring it up but I can probably answer
virtually any question from it it's just
a little bit tiny little bit more about
me than since I didn't they can't read
the bio I usually do this presentation
with jr. one of the other folks on there
but along with the DBA I've got a book
with J James in red red you can find us
there straight too interestingly enough
we actually did this we had this slide
up on at RSA and we a nail kit as a joke
and like no one really got it cause like
they don't really slide but now it's
like even funnier because like now we
actually take the blame for verizon
buying AOL so
yeah so yes actually I'm gonna leave
this up there for a second how do people
to know what the Verizon data breach
investigations report is hey hands done
I ever this is now I'm asking you guys
are security people how many people
actually how many B or C has this piece
this is really good because now now I've
got it now I've got yeah I wish the
camera was pointing that way so as the
CISSP you're suppose to be honest so
this is a question that i have found
that i should not ask but I'm asking
anyway how many people have read the TBI
our cover to cover and that's ten feet
would thank you for it and actually I
think rusty for your honesty and there's
no disparagement for you guys in this
one it's a sixty issue page document
it's a lot to take in and and we have
found that most people skim through the
documents or read through it and and
actually I found that more this year as
I've been talking to folks about that so
it's gonna change it may be a little bit
of how we do the report next year but
the reports been out for about eight
years and that we've got about ten
eleven years of much total data for this
thing and I we have a gallon of covers
up here that you can see you know
starting from way back when all the way
up till now and the last two covers are
really important and I'll talk about the
bar graph in a minute because folks may
not may not know from last year's cover
but last year's cover was entirely made
from the data within the dbi are
everything actually there's a there's
knots on the covers of you go again that
you can actually break it down to PDF
and see it every dot is one of the
breaches that are in the DVI are it's
like literally every breach we had last
year was on the cover and we did that
because we used a machine learning
algorithm to figure out how to cluster
and organize what the breaches are I'll
talk about that in a little bit but not
much and this year it's the same thing
so this year it is just a pretty picture
it actually is made from the data within
the breaches as well too and I'll talk a
little bit about that a little bit later
on but what's kind of cool about the DVI
are this is my first year working on it
formally is that we've really done a
great job getting more partners and
especially over the last couple years
we've really jumped more partners than
like even the share week we did more and
they jump from here to here this year
from 50 to 70 it wasn't just normal
breach data we actually people knocking
down our door you know a virtual door
literally saying hey we have this data
will you analyze it we put in the eBay
are we one actually give people a
picture that they haven't seen before
you guys asking questions please please
do stuff with this and it wasn't breach
data and I'll cover that a little bit
too so because it wasn't breached data
we had to go what we thought was beyond
the breach we'd be like if you read the
report at all actually for a 60 page
report it's kind of readable but I'm
gonna talk about that readability thing
in a little bit too so with this before
we enter it's like we caught beyond the
breach because we had 12 terabytes of
extraordinarily different data and I'll
cover sewing to cover most of the
sections in this one folks may not
realize this but our normal breach
corpus which is almost 200,000 breaches
right now in the breach purpose is just
shy of 200,000 is about 15 mega tits on
one of the crappy thumb drives that ya
vendors and are as they give out of the
boots and you can actually have
redundancy yeah put on a couple of them
right to have them around just it just
encrypt them kids it does have some
interesting stuff even though it's
actually like somewhat amount of Mines
it's got some finnish news so we went
from working with a really well-known
data set for eight years to working with
a bunch of stuff that well as folks in
the team have worked with maybe a little
bit here and there 12 terabytes of data
of different kinds of data we've never
really seen before as part of this whole
thing so we had to come up with some
underlying principles for how we were
gonna work out this new section in the
Dvir
so one of the principles was avoid
simple accounting I am NOT here to speak
disparagingly about anybody else's
report I do see a lot of just simple
counting and InfoSec reports and their
report and then doing you know showing
the counts every years there's nothing
really wrong with that but that kind of
doesn't give you a good statistical
picture of where things are and it may
not be helping you know move the ball
forward a little bit so we wanted to try
to shy away from that
we also wanted to not duplicate anything
that our partners were doing I am so
glad Steve is here because I really was
counting on him being here so thank you
ever come see don't duplicate their
report content so we had great partners
who produce their own reports and that
whether it was the breach theater or
whether it was this new data it's not my
job it wasn't my team's job to actually
go duplicate their efforts why would I
do that you can read the report most of
them are actually pretty good to read we
have that we got data from a lot of
different sources for some of the
different sections and it was really
well it was the same kind of data it was
in a weird different formats any one
that you heard me talk about data before
this was kind of the whole data
cleansing data aggregation so we had to
cleanse it normalize it get everything
together it kind of did do all that
stuff and we had to come up with
interesting questions so we just don't
like to report stuff that's one reason
why in the non non new section in the
regular will breach section that we have
we didn't just regurgitate the same
stats from previous years or show some
of the same graphics from previous years
because honestly we respect you too much
to do that and while we may be coming to
the point where there breach component
of our report is like the beige book in
economics where you will have like a
broken out section or something like
that next year the reality is is for
this new stuff we wanted to ask some
questions that we weren't seeing
answered in other reports or other
places we had a unique opportunity with
the data that we have and literally
scramble to answer them because by the
time it all kind of came together we had
like three weeks that write the thing
like and this is like three look through
three weeks to go through 12 terabytes a
day that we've never seen before and
come up with cool questions answer them
along with the other stuff that would
normally do because it was a compressed
schedule this year for a whole host of
reasons so one of the new sections that
we actually got to do that we broke out
from a smaller section that we would
normally do is phishing so we talked
about fishing in the previous couple
reports and you know this year we got to
work with a couple more partners then
usually the single one that that we got
to work with so we got data from like a
couple hundred thousand you know
basically people a couple thousand
people that were fished over with
multiple campaigns over time and we
wanted ad we asked a bunch of questions
for this particular thing but the
question I'm going to talk to you about
here though
that we asked and that we answered it
with this data is how long do you have
as an organization when if when fishing
first like campaigns being launched
against you how quickly do you think you
have before someone actually responds to
that fishing event so I'm willing to
take a couple so the ones that read that
please don't answer this - you know what
the answer is there everyone else that
didn't read it what is the answer two
minutes that's 120 seconds yeah okay
does anybody else want if I take a stab
at this we have two minutes to tell the
first bite from a phishing campaign got
one hour so - two minutes one hour if I
does want to go for a third one come on
somebody all right five five seconds so
we got we have a pessimist a slightly
with a really bad pessimist a pessimist
and an optimist okay that's bull so the
answer is 82 seconds this and so and
just to give you a bit of background is
that this and I could just walk away
with this number and we could go to the
next section we asked a couple other
questions you can read the report for
them but I found this one to be kind of
the coolest one that that's out there
and if you promise not to tweet
something like which is a yeah yeah go
ask that right beekeeper my guy will
tell you something else if you don't
promise me not to eat something so for
this 82 seconds one if we wanted to know
how how how fast people respond to these
and it didn't matter the campaign size
and it didn't matter what levels the
campaigns were going to and didn't
matter what department that the
campaigns are going to I didn't matter
what devices that it's like we actually
went through this whole series of
iteration so this isn't just a really
basic you know naive analysis we looked
at all sorts of combinations for this
thing and from the campaign launch till
the first person opens and then does
whatever the insight is whether they
open up the attachment or click on the
link and go do whatever it's like
basically initiates the thing that could
cause the endpoint compromise was 82
seconds
[Music]
so so I bought one stuff so we have a
question so I could talk about the other
staff so we asked that question too and
we wanted to know how many people also
okay out of all these things like how
many people in an organization are gonna
open a first thing message opens aren't
really that bad by the way
selling huh well I'll do that with you
but since you since you started this I
will go down so so opens aren't bad so
how about when a campaigns launch the
average organization this is across
average like was how many what
percentage of an organization is
actually gonna open a phishing email
campaign anyway else take one more
twenty percent so the answer is
twenty-three and change twenty-three
percent are gonna open it now before I
actually go do what you want me to do an
answer your question the reality is is
why why opens aren't bad so I still love
security awareness is something that
it's all my passion I still serve on the
board first hands for security partners
so I still do a lot of that stuff and
people have to open email you all you
all I guarantee have to open emails part
of your deal like I've been trying not
to for the best it is but I have to open
email to and so there's a lot of a lot
of jobs were like communications or HR
legally you have to open email so like
the opens really aren't so bad most of
the stuff is locked down enough that
opens aren't gonna be a big deal from
from a mail client perspective however
11 percent actually do the clicks opens
whatever you want to call the the actual
thing that causes them our event to be
successful no it's 11 percent
it's a representative poll
yeah it's actually really depressing we
took risk so do we have any stats on
whether people contacted orgs or
whatever we didn't get that data I'm
sorry so I know we don't have that we
get the DIA that we work with and we try
to ask questions for and that's one of
the ones and if you read the rest of the
report we have a section on malware and
you'll see how this ties in today read
some other parts of the report this is a
really bad thing like actually this is
the 82 seconds is bad enough the fact
that 11% we're gonna actually do
something with it and cause the
potential malware event to occur is
really really bad because really that's
how everyone got in last year if your
every news throw you read was some third
party getting fished and then getting
credentials because they got malware and
sought the blah blah but you saw
headlines that you've heard the report
you see the report so this is really bad
and this is basically you know one thing
to talk about the report is we talked to
two minor so minor was great they were
nice folks over there
and we talked a couple of folks as well
to that basically said looking an
awareness program is key a really great
awareness program I talked about that a
source a couple years ago too
I also say you need technical controls
well I am NOT going to proselytize any
particular company if I say fire I like
device would be something that I would
absolutely invest in if I was still
running a security program somewhere
because you're you probably you're
almost a fool not not to run towards
awareness so we go from fishing to
malware because that's kind of what
happens where you go from fishing to
malware wondering what something
actually happens and we wanted to one of
one of the questions we asked a couple
questions but one of the questions we
wanted to know is are the malware attack
profiles against different types of
organizations so if you read the DBR we
actually group organizations by their
Naik's code North America entry code so
we grew to at a high level that way and
our are these organizations targeted in
different ways like do they see
different amounts of malware we wanted
to know if there was if there was
something along those lines so I'm just
giving you a snippet because I still
want you to report good I want to say my
report there's like 10 authors but it's
not my report so I want you to read my
report so the answer is yes right so if
you're a retail organization you're
seeing on average
of 801 Mao or events a week and if
you're an edgy you especially a college
you're seeing like so like you're
screwed over there basically what you
are and over here like you're not so bad
we have we have some profiles for a
financial and some other ones in the
actual report itself too now we got data
from five different places here and so I
mentioned fire and fire air was one
Colorado was another one we have a bunch
of other ones too where I got a year's
worth of malware event data across tens
of thousands of organizations I can't
tell you how many because then you know
what the actual customer base for most
of these places are so we actually
limited the number in the report on
purpose it's a lot of places and we got
data we looked at all these Mauer
capture events from all these different
places and aggregated together and did
all this stuff and did this here so and
I think what's also important on here is
like you'll actually see that every so
often there's like a little spike there
there's like a little peaking spike here
and we talked in the report about this
where you have to not only watch what's
happening normal in your environment and
you're all capable of capturing the same
information if you've got this kind of
device in your hand we actually
encourage most of the sections was
repeat what we did and then learn from
what your own environment looks like
more than care about what was in the
actual report itself but so you have the
normal average everyday stuff that your
help desk is probably dealing with which
I would suggest getting that out of your
help desk and maybe talking about it
more of the security level but then also
deal with these floods that happen
because these are malware floods that
actually occur and a lot of
organizations like in some of these
cases it was a single or getting some of
these actual floods that was going on
here so that's really important from a
malware side it's like and this was a
cross vendor so this is the cool part
about the report this year right this
wasn't one vendors myopic view in one
one little industries and whatever a
niche thing doing over here this was
every single possible industry every
single size and global this actually
stay in global as well um if I think
hopefully fire is not learn when Paulo
does not in the room so the other thing
is for all you that work at an
enterprise read your contracts because
like this is your data and you may not
know that this is your data it's
anonymize I don't know who you are but I
probably knew enough to figure out what
most of you are far from this thing
because we're pretty smart back back
- so I probably couldn't figure it out
but it basically this is data from a ton
of people so this is actually pretty
representative so the other question we
want to know what's okay fine they're
all getting hit with malware and you
can't actually flip open like anything
like you newsreader these days at all
without actually seeing that someone was
breached with super sophisticated
advanced targeted malware for that
particular organization well it turns
out that seventy to ninety percent of
this is actually super unique and
separate for that particular
organization and what we described it is
like a special snowflakes fall
everywhere and and the reality is is
this is the automated infrastructure
that Michael Wortmann was talking about
a little while ago just in this room and
he was talking about it from a
vulnerability perspective and a scanning
perspective and this is their automated
infrastructure for doing getting malware
onto your environment right they're
tweaking things because if you're still
investing in plain old signature
antivirus and you're not doing much
beyond that they're gonna get by you
like they actually this worked this
worked everywhere last year it worked
everywhere this year so far I mean this
is the modus operandi and this is we're
still using 10 year old 20 year old
technology and thinking to protect our
stuff they're doing this to get by the
simple stuff that we've all got in place
because we checked enough boxes to
actually go do it
so yeah yeah so this idea so these are
the Decrypter got the cache for all
these particular ones right yet so this
is gonna get by the majority of stuff if
you don't have the advanced capability
so every single air I won't say every
but the majority of good vendors out
there Brandi virus have options to like
tell you at least not have some of this
stuff happen to you like they're a
little smarter than that you've no
devices there are few smarter than that
to to go do it so you can't just rely on
the simple basic stuff to get by anymore
because they know it works and they're
getting by and they're doing it this is
why it works they're doing it at scale
like like I actually have a little bit
of respect for them a little bit I mean
it's a weird kind of respect for them
you have to you have to do something
when you're studying breaches all the
time it's kind of depressing work so the
the next question that we have for this
particular section is yeah we wanted to
know what's changed so thankfully Wade
kept all of his notes from when he was
doing stuff back at I even forget the
name of the company
way back before verizon bottom I
actually forget who they are so so I
keep a he kept thought because they were
actually do an internal type stuff wait
wait wait a day to freak just like the
rest of us are and he kept all of his
notes and all that kind of stuff so back
in 2005 7 families for all of us that
are old enough we actually remember most
of those names and even some of them
slowed this today too but like they
should bring back very horrible scary
Mary's first memories what about us
accounted for 70% of the mail cut
activity back then and so we said okay
we have a lot of data from a lot of
places and before I actually mean you
can read what's up there but I mean if
you if any of you work for an antivirus
company or one of these network
appliance vendors that actually do this
kind of stuff in stream whatever I kind
of don't like you right now
cuz you made it really impossible to
actually do this analysis because you
got these stupid separators and these
stupid names and the things don't match
and they don't cuff that it was a
horrible pain in the neck to analyze
this across five different vendors could
not actually it was the hardest thing
ever Jake Jay and I actually spent two
and a half days writing a special custom
you think that actually does a bunch of
stuff and some fancy stuff to try to
make this stuff work right and we still
couldn't do it really well but we got
like sixty percent of the way there so
but so basically to do that we got to
this next step which is there's about 20
families and so there's the sinister
seven up here so this is the center's
just a top seven you have got here as
well to you know they've changed because
in the old days the good old days the
simple days it was just people trying to
be jerks and stupid and kind of get
their name out there and do all sorts of
whatever some of it was a little bad but
the Rumia for the most part it wasn't
horrible now like these things are
terrible like zero access is terrible
ZBOX horrible and drama is not great act
like these guys these things are nasty
horrible things that you really evil
things and like it's really bad so the
landscape has changed a lot and there's
actually more diversity because again it
was 20 families versus seven but the
reality is even this top seven it's kind
of scary so we got a chance to see just
you know at the level across vendors
across different across different
organizations and this is actually
interesting too I should say we actually
tried to run this analysis across
different types of orbit again so the
name
so it really didn't change a whole lot
like finance had some different ones and
whatever but that top 20 was a top 20
across them all so the top seven floated
differently but the top 20 were the same
ones so the attackers are doing great
stuff at scale and doing stuff you know
pretty pretty amazing cool stuff at
scale that we're not defending will
against again so you know basically
start recording some of the stuff on
your own take the data from your devices
since they're doing it once you get your
own data to and start working with some
of the stuff like we actually did up
there one of them so this is this is the
beginning of the what I would call
controversial sections we have a couple
controversial sections in the DBR this
year and the one the first one is this
one there's generated a call a little
bit of a buzz because we worked with
actual micro workman's org where if you
saw us talked earlier a lot of the same
day that he used for the stats for what
he was showing earlier the same stuff
that we use to kind of calculate this
stuff here so now I'm gonna set this up
in that you know they are an interesting
company they they actually work with a
ton of actual org is like Dell is a huge
customer there's and all there am
assessed folks so it's like you know
tons and tons of machines but they also
work with alienvault and there's a lot
of crud in the alienvault data set and
how they do their stuff and the whole
way that they connect people in the
threat to exchange like there's some
crud in there so it's hard to do stuff
and the idea stuff that they work with
sometimes and things don't you know
don't flip right and they don't detect
the thing as well but there's a lot of
caveats and we caveat it everything like
if you read the back of the report we
talked about all the things that are
possibly wrong with the report we have
the footnotes that talk about that too
we talked about the biases and the data
very well in the report I think so you
set their goal look good looking for me
to kind of read them on there so for
this one here we actually looked at data
from all the orgs that Michael was
talking about before and I think I think
was even bigger because we actually got
a larger dataset too so this is like a
couple hundred million successfully
according to IDs hits primarily four
million well but a bunch but from down a
couple other companies what what were
the actual things that were hit and we
wanted to ask a question so how old are
some of these vulnerabilities that are
out there you know because we we keep
getting told by all the compliance so
it's patch patch patch right we gotta
patch everything right away
so we want to know like what was being
done out there and this was an
interesting chart that we put the
it's basically you know if you would
take what the popular culture thinks
everything is you'd be seeing okay well
the past couple years should be where
we're seeing all the exploits happen
especially in 2014 because earlier for
2014 data and you got like you know 2007
we're like that's like the biggest spike
then you've got stuff going back to like
we said their report they're partying
like it's 1999 now these these are kind
of SNMP things back here so it's the
it's the look of a low hanging fruit but
the attackers are looking for
low-hanging fruit like seriously like
there's a bunch of old bones that are
really easy to wrap up in to exploit
kits that they're looking for cuz
they're doing automated scans across the
entire internet and if you're not taking
care of some of this stuff on the
perimeter this is what they're gonna go
after i we're not saying yeah i can't
talk to you about targeted attacks i
don't know your organization i don't
know what the threats that you
particularly face as a particular board
but i can tell you that if you're
leaving stop hanging out there that's
publicly available or if they get in
with that malware and they're actually
trying to get through and do lateral
movement within your environment they're
going after the easy stuff yes so this
is that this is the idea say farther
from the perimeter or from wherever the
stuck with stage internally as well so
so just like with the other data it's
like the thin like the like of the the
Mauer data if those appliances were
placed weirdly and stupidly improperly
and we cover those in their port we
actually talked about that we cited that
as one of the biases we don't know how
those appliances replaced michael has no
idea where all the positioning from
those those but he does know that
there's a mix it makes of interactional
for these things so we actually didn't
get that so this isn't just perimeter
this is both lateral movement and
actually perimeter stuff coming at you
ask yourself the question what are the
typical CVS essence so yes and I'm so
actually don't make me put up that slide
hold on one second this is looking at
the exa this is we took yes sure answer
yes oh so this is anonymous so just like
Michael said earlier this is completely
anonymous data so I don't know the
actual breaches like we don't even know
if this led to an actual breach of an
organization we just so yeah I mean if
everybody was really good about felon
and breach saving gave us the cbss is
that actually did that that's sure yeah
so if you just volunteered to work for
me and do that I'll be you've all said
yeah that's totally cool yeah so our
breach date is some of the ugliest thing
you have ever seen and I will show if
anyone that wants to see it you hit me
up and I'll do it look at Wow Google
hangout what the illustrate just how for
we did it's terrible like people don't
fill it in we have cbss if we actually
shared our cbss dated with michael and
he laughed hysterically over hangout
like you could not believe just how
pathetic our CDSs data would because we
just don't get that level of detail like
we get barely what's barely what you see
in the news actually some of the news is
better than what we get for some of the
stuff that we get in there so we tried
it's a great question we did try so fire
everything it's really old and this is
both nickel I don't want external so
this is the thing we're like start
cleaning up your house and like let go
download Michaels thing like after it's
up for the source recordings and stuff
and see the stuff is there we know this
isn't perfect we want to work with Steve
and others to make this a better thing
and understand things better we know the
IDS's aren't perfect and how they
trigger our perfect CVS s3 has the whole
ball chaining which is huge and that's
gonna play a huge factor on this and so
there's a lot of stuff going our that we
know but this is a great baseline to
start with and we knif we want to work
from here and kind of bring as many
people into the fold to kind of do this
and you don't have a lot of time right
so there's not a lot of time to do this
right so
if you start from here to the weakest
this is a weak exploit occurred after
cb8 publishing it's a cumulative thing
for a hundred percent afterwards so this
like after four weeks like fifty percent
are a car actually going out there like
you don't have a lot of time like and
actually there's probably a delay here
with Michael's data capture too and it's
a lot of its relying on good time
settings for the actual organizations
and we all know how great you keep NTP
in your own organizations up to date
reconciling so the reality here is like
this could have to be a lot worse than
it really is and we and because of some
of the time-related dated we didn't show
things like heart we actually had some
data on heartbleed all that kind of
stuff the hit last year we didn't want
to show it because it really was skewed
because it was like because there was
timing or zabun here but after going
through and cleaning up a bunch of stuff
you really the exploits begin like and
these are actual again come from yet
compromises known because it triggers
within like literally right after the
things out there so these guys are right
on top of it so you can read Michael's
talk for some of the other cool stuff
but again this was this was some
controversy right so like the
Twitterverse knee I blew up a little bit
and like people were a little bit yeah
hatin on this particular thing I get it
so the reality is is we want to work so
I we we are not saying we are perfect
we're not saying we're always right
we're not saying we did they did a
hundred percent that this is the best
data but we will take more data so if
you work for a vendor you work for an
organization that give us this data we
treat it really well we deleted
everything we were supposed to believe I
can provide can actually prove it and we
actually have a lot of stuff so we will
work with a member but this is one of
those kind of like challenges there so
there's another section I'm gonna breeze
through this one because like this is
been in the news a lot it's gonna be in
the news more unfortunately so like how
many people have heard of the pone
amount cost of a data breach average
thing he just released it this week okay
yeah so I'm not gonna say anything more
about that except his word his name's in
one more section on here so we actually
worked with actual cyber insurance
breach day that's like the cost of cyber
insurance so it's not perfect right so
this isn't like the actual cost of the
total or this was how much an insurer
paid out but it's actually honest data
like I can call you up on the phone and
ask how much your breach cost you you're
gonna tell me ten billion dollars
because you want to look like it was
impressive or whatever so I don't know
if you're lying to me when it's a survey
and I could call twelve people in your
Oregon you could get maybe fifteen
different answer than I could average it
out I just don't trust surveys period
it's just to me because I've actually
deliberately lied on surveys to prove
that sorry
kind of bad so just throw an opera so so
we actually plotted this date so we
actually got this data for about 200
actual cyber insurance claims over the
past couple years and we plugged them up
here so these there's a log scale so
there's actually log this is a log log
scale so automatically it's not linear
stuff don't make me tell you about this
there's no there isn't it may look like
nice straight lines what we just did
that cuz it's log log there's so it's
average is already stupid because we're
already talking log scale just be just
because of that right here 30 down you
can take a look at something I actually
regret this this wasn't missile wasn't
my ID I would blame day because he's not
here these we actually did this thing
where we calculated our own average cost
of David we did 58 cents which is where
that line is kind of hits up right there
we never said it then that is like no
one read the report you guys prove me I
read the report and and they just honed
in on the headline and now that's been
the thing and even IBM quoted this
because it was kind of horrible so it's
like that's what ours is this is Hanuman
zijn it's like there are average we know
is stupid we actually said it was stupid
in the report and this is the actual
thing which we used with we actually is
a linear regression model I'll give you
a prettier picture of that so when we do
the linear regression model we actually
it's and you can see so anyone knows a
little bit about stack I'm not going
heavy into that the the fact that there
is this great thing that stands out
really wide is that so this is the
actual thing that fits like kind of
right in the middle and like so that's
like the the pinpoint thing I have a
chart for that in a second the graer so
the wider the gray area is the less
confidence we X like basically like the
range basically gets larger it's best
way to phrase that there's a range
associated with this stuff and I'll give
you the range right here so so Brad so
this is the expected value in that
middle and like as you know depending on
if you want to be a fun guy you can
actually go over here and tell people
like you know the world is ending if you
want to be way too conservative and look
good you know
they may not be too ugly to go over here
the truth is somewhere in like the
middle here like so if you have this
many records it's gonna cost kind of
roughly in between these numbers
together do that this is what people are
used to from real financial loss models
like at the executive level when they're
looking at financial loss they don't
look at it in average terms they
actually look at it in a range terms
they look at in distributions like we
just put here our model is horrible we
say that in the report our model still
isn't perfect one reason why it's still
based on records I can show you a bunch
of other charts that show why we have
like a ton of enumerations in our
various framework we analyze over 300 of
them to kind of go do this
and the reality is is nothing actually
helped describe it better than records
so far there's about half of this half
the half the cost of Reach is not
described by what we have available even
what Poneman has available it's really
there's a bunch of unknown stuff in
there so we're trying to work with cyber
insurers and other organizations and
even po naman to try to make this better
and tighten up the model have a better
picture for folks that are out there but
the reality is is like you I'm gonna go
a little quicker so the reality is you
really just can't go by the simple
average but you also can't just trust
our model completely either but you need
to if you want to start working with us
let me know we will work with anybody
that wants to talk to us about this kind
of stuff but we've got a lot of you're
doing it wrong stuff on this one too
just as an aside in the cover stuff
because we're actually able to do that
cost of a breach thing yeah we did we
did come up with way of doing it the
cover is actually based upon that so
those waveforms are actually the actual
cost of a breach of the particular
industries we actually have a whole
paragraph and a half on the back of time
what that is I'm gonna go into it here
but is anyone recognize what this with
what we're ripping off of here anyone
recognize it although we're riffing off
of do a division cover wow I wish I had
one of my t-shirts actually keep give me
your name let I'll give you a book
seriously
one of our other sections that was
looking for problematic and I'll kind of
go this really quickly we talked about
mobile right so everyone's about mobile
breaches bubble security every year we
get asked about it and we go we got
nothing our actual data set has very
very little related to mobile like it's
like two records I think last time I
looked so we got nothing about mobile
being a cause of actual breach that we
have in our 200,000 corporate
so how am I gonna talk about breach how
am i tell about mobile when I don't have
any thought about mul about so what we
did is we got Verizon Wireless to give
us six months of all of their equivalent
of on device if it's Android AV data the
end there's IDs data that we have from
them that's on the entire verizon
wireless network and we have some
advanced detection stuff that I can't
talk about that's also on the rise and
while there's Network to so we have a
ton of trigger data that we can go
through but it's six months of this for
the entire verizon wireless network tens
of millions of customers I can't I can't
tell you that I'm actually I tried
saying it once and I got yelled as I I'm
actually smacked down for that number I
know I have no idea why that
super-secret but anyway so we actually
we have to broke the malware up into two
categories this is the entire category
we came up with above all explained in a
minute so this is over time the number
of unique devices viewing my work per
week and actually we talked to a couple
organizations outside of us and we
confirmed that there was actually the
decrease that we saw Verizon relish was
actually something we saw everywhere
that they saw everywhere so this is
actually what you see there that spy can
happen though that was actually stuff
that was very well it wasn't exactly it
was very similar in other people's
networks that are queuing out there when
the Bell Canada guys saw this he was
like whoa how'd you get our data so it's
kind of cool so but that's everything so
we actually coined what we call a
diluent where so at annoyance where is
any you know anything you've installed
or something that might get on your
device for whatever reason that that is
basically showing you abb's you don't
want to see maybe stealing your IMEI
like really low great like doing your
grade stuff that almost anyone could
write there's none I'd know it's where
which becomes C to things that actually
become a denial of service agents that
basically they're really nasty stuff
that your pcs get right the same
horrible stuff that exists out there and
I should take a moment to basic
basically say oh by the way there's
virtually nothing on me
like literally virtually nothing on the
rise and wireless network iOS Y that's
compromised like this it was literally
all Android like it was so bad that we
really couldn't even talk about iOS and
like we couldn't even dedicate time to
it because there was so little iOS on
the actual thing so Android really wins
this
pretty pretty well the horrible about a
bloomin what they win it this is not a
data clinch and an autumn anomaly we
actually looked we asked we asked a
they're changing is around there for
that particular week there actually
wasn't any significant activity of this
particular type going on there so when
we actually filtered out and separate
the grades yeah this is what comes there
we may have made a mistake I can't ask
you to look at that data for me but we
have their own Verizon Wireless guys
look at what we did and they said no
that wasn't a mistake
so you can take my word for you take
their word for it is just our data we
are trying to solicit more things about
Canada might be helping us out next year
to a couple other ones might so we might
see different things but you can see
that you know the numbers go way way
down a little more consistent with when
you get further out for for the actual
higher grade stuff but they're really
interesting for me here was it lasts
about two days and some of that's
because Verizon actually stops it but
some of its also like the phones that
people delete the app the phone to get
rebooted like these are really unstable
devices for malware to try to live it's
a very very difficult it's a very
challenging environment them to work
with so the timing there is like in it
goes way out it's a pretty long tail
thing but we got a lot of this from all
the people that make the money scaring
people into thinking that they need to
have very expensive systems to do
malware secure now we want people to do
better with malware we actually say in
the report do better with your stuff on
mobile right you know you have an
opportunity now you've never had before
to secure this environments of the
attackers don't get there so this is one
thing you actually really gonna need to
do really quickly industry patterns
you've seen this chart last year it's
the same team map as last year the only
thing we did is we added a little bit of
a three-year history and bar charts
below it so you can actually get an idea
at a glance looked at what's there I
have this up there primarily for you to
go and like take a picture this URL but
you can either on the be put up the
source for our there there's an
interactive version of this particular
chart online that we actually made this
kind of shows we actually broke the
industry's down to one more an Xcode
level down so like the high level stuff
is busy is very very high like finances
like everything of Finance you break it
down you could actually have more things
like central banks and
yeah insurance companies and things like
that so very diverse when you get even
from what one further down and we wanted
to show what this one is you know just
because you may be under the same high
level vertical we looked at all the
various enumerations around threats
related to this stuff and group them and
clustered them by that in here so I
encourage you rather than we talked
about this I wanted to just call it out
let's go here and plate this is a home
they're devout there and there's five
five or six scenarios that we put up
there for you to walk through but this
is to get you thinking outside your I
sac box right basically
it's great that you're part of a nice
act if you are if you aren't maybe you
should be and maybe you shouldn't be
part of an I sect that is just like and
your vertical this means that like on
here these guys which are all different
colors should probably start sharing
information with each other like
indicator to compromise and all the
other good stuff if you're if you're not
if you don't see your industry all kind
of leveled in the same place about
thankfully like you know red is kind of
up here and I think that's management
might be information on come on forget
right now but like we have to think
that's one of the scenarios that we have
in the actual report and also in the
online thing this is one thing we're
used to take a look at and try to
understand where you're you know
threaten brethren are and be working
with them and now you know you're
relying on us to tell you this from our
breach corporates that we have this also
means you might be wanted to talk to
more people outside your particular I
sect for the folks that actually in the
area the a CSC advances cybersecurity
Center which I used to be a part of
those guys actually are they they're not
just vertical they actually go
regionally they won't take anybody in
because they want to work with everybody
they might not be a bad place start
sharing information with and then
finally we just talk about controversy
one more time for the folks that have
her at the report this this has been
described as the snarky astre port ever
or
I would like probably call it the most
irreverent report ever but the reality
is it because we tried to cover a lot of
stuff that was too like statistically
hard for people to understand that that
don't do that normally and also because
it's really just depressing breach data
we we actually include all of the
irreverence in there and all the pop
references and all the other stuff that
we do primarily to make it easier for
folks that just to read so if the length
of it is actually causing you to stay
away
I really encouraging not to do that
because it's pretty readable especially
if you do parts and I think we got a
couple good one I think I got I got a
couple go on lines anyway but so I think
and so the I asked you a bit like two
minutes left
yeah if you hit me up later if you think
there was too much snark I really want
to know that because we're actually
working on like how we're doing next
year's report like right now so if you
want to talk to me about like what you
feel though the casual tone the report
is will let me know that but I am now
got two minutes for whatever remaining
questions you might actually have from
this one or any section in their report
besides this one more stock ok back
yes so there is a so the multi-state I
stack is probably one more like they
actually go across organizations so you
can take a look at the model that they
have the advanced cyber security center
I'm no Jonathan you don't know if you're
doing stuff with those guys now John
forest from Liberty Mutual's you're like
the Liberty folks are a pretty major
folks that I haven't started there with
my another the they are a cross industry
group regional here to Massachusetts but
and and and Maine and New Hampshire and
Vermont probably it's mostly I think
it's mostly I never I think they got
something at your folks as a main folks
they actually are cross everything like
so they they aren't just aligned
vertically so they structuring they're
doing anything stuff that they're doing
it's it's a really cool I sac model to
go do that you've got folks like threat
stream and threat connect who are also
bridging some of these threat groups
together you can form you on on there as
well - I'm not proselytizing any one
particular place I'm not here to sell me
about anything I make not make Nothing
off of giving these names out but you
can go find others like that too it's
you know you can take a look at what we
did in the report especially with the
the online wanted to see where you where
you're in the che might be aligned to or
hit me up and I'll give you a special
thing if I can for it and basically you
know that's one thing where it's really
important for you to be sharing with the
right people and as fast as you possibly
can to
we're talking about records almost
Rupali is that that being sort of the
primary unit of measurement
other kinds of things sure so so if you
look at various community met the entire
enumeration set for what we do we try to
require breaches with is there it's like
literally every sin every detail we
would like to record about an event is
listed there what we know in the in the
form that would have and we we took
about 300 of those so it's like
different kinds of threat actors source
countries target systems like all sorts
anything you gain any technical way to
describe a breach and some of the
records were actually not bad so studies
so of these 200 we actually got a lot
more detail than we usually get about
some of the other ones too because we
got them from the cyber insurance logs
which is great they actually they they
care about data because they like
actually oh it's not that's great
working with those guys and even with
that technically so these were pretty
filled in records from across these
enumerations even when we factored this
in and we tried to run the models in
different ways and do some stuff they
actually didn't move the needle like
those those basically those were baked
into something related to the breach but
again about fifty percent is still
unknown and you can see how that goes
out as the fan big large and larger in
that several by comma several pots the
the the distributions art that you saw
that's that's huge right we have with
there's 50 percent of things that are
unknown besides records about a breach
that may relate to organizational
culture that may be that may relate to
how an org is structured that may relate
to how it work processes like other
stuff that were that is not related to
the actual details of the breach itself
and that's actually scary it's also kind
of exciting if we could get that
information and the insurance companies
really eager to get that to right now
they're trying to figure out what to
help us figure out what that is if we
could do that like it like and it and
that's why I say roof leak is like we
were hoping that we had like something
about records and like no we still just
plug records in you gets I'm not on the
flip side if we want to live with some
like like wide-ranging confidence
intervals for your estimates you've not
got a good range to us are working from
when you go back to your organization's
and you can start having world
discussions at like
you know the finance table about things
and how you should be protecting things
and the best thing
things that you couldn't do before with
multiplication like literally like we
have this things like division and
multiplication art models like they are
involved in models but they themselves
on our four-legged models you now has
something that gives you far better than
that and if you want to give me a record
cat and like I will give you the actual
you know range if you want that or plot
a chart for you or whatever like we just
did this for a soccer everything up here
if you want the coarser stuff we'll do
that when we're glad to give you more
data if you want more data um so yeah
actually so that the report actually
when we did this year especially for the
the breach stuff in in the rest of the
report we actually covered that and we
actually talked about the shifts over
time for for a bunch of things so I
would actually for and I'm not actually
um is I'm not I'm not just saying go
read just to go read though I'm also
saying you could leave a minute like so
like in the point in yeah I know that
like not many of us I could run point of
sale environment but if you run a point
of sale environment read that section
cuz we cover the history of it what
happened there really really well what I
will tell you is that we have seen a
huge shift into what people are doing
with the use of fishing there's a huge
deck that a huge diminish in the use of
keyloggers
so like the hold the other holding like
area of digging and everyone's basically
saying I don't need maybe when I could
tell you the shift over time has been I
don't need to be a super smart technical
criminal anymore you're people are
falling for stuff because you're not
treating them well and you're not the
culture your culture sucks and you don't
rate awareness program you know other
right technical control is a place to do
what you're gonna do so I'm gonna go I'm
gonna fish you or one of the people that
you do business with I'm gonna I'm
definitely gonna get in I just told you
you're almost guaranteed to get out of
these places you're probably running
something that I'm gonna get by with
really trivial malware and once I'm on
there I can pretty much do or want to do
with legitimate credentials because
you're not monitoring validity
democratically is because you're also
not smart enough to use two-factor
authentication on your partner like
literally that was the story of the DB
era this year like we didn't come out
and say it that abruptly in the DB IR
but literally that was the actual story
for so many things
vir and literally if you just patched
your perimeter stuff you would have
gotten 25% of things that happen less
your wouldn't happen if you did to
factor 25% of the things last year
wouldn't happen like Syria like this is
no joke this is like you know and like I
hate quoting best practices because both
of both of those two things are best
practices but the reality is like that's
all the simple things folks actually had
to do and I know it's not simple I
worked in an organ I know I know the the
rocks and mountains you have to move to
get this stuff to work but literally the
data is here now to go like you're gonna
be a victim guys you really are gonna be
one because they're just arbitrarily
going after the up this stuff
opportunistically yes they target some
places obviously we're not talking about
those but for the majority people that
are out there
clean up your houses and you're gonna
actually and this isn't a bear
conversation either because like at some
point when I've had this conversation
with Wade and I actually have a Josh
couple weeks ago like if we actually
clean up our houses here and we do a
good job of getting the stuff and making
them have to go more technical maybe
even having them go to mobile like we
have just raised the stakes in this
cyber like I'm not gonna use the word
war because you just had a panel think
about that here and I don't wanna talk
about that but we just raised the stakes
in this whole battle that we're facing
right like we are basically escalating
warfare so like right now be a little
thankful that there's a lot of people
that haven't cleaned up their acts
because honestly the ones that are
you're gonna do better because there's
no gonna keep going after the easy
targets the more we get cleaned up this
escalates to a point where we're not
ready to handle yet anyway but at least
for me I for probably five years away
from anyways let's write not too big of
a deal for everybody here but the
reality is is that really basic stuff
that the criminals have found the way to
do things that's working it's like doing
right almost like half the year gone
it's working great for them this year so
far - so we haven't changed a whole lot
since last year anyway so maybe after
the reports out as more people go
through it and read it you might get
more someone so you have more people
change in their ways but we're still
gonna probably see that as a big thing
next year at least that's what we're
saying at least we're trying to get
mid-year data we may not really we may
not release a mid-year report but we're
trying to get a mid-year view of this
that we may tease some information out
and if you ask me nicely on Twitter I
may you know give you an off-the-record
comment about
than in July oh he's not framed so
anything else oh thank you very much one
more oh yeah so didn't visit dessert
actually this is a good cause every year
how many people know we have a puzzle on
there that's easy are we here okay so
every year for those of you don't we
actually encode a puzzle into the Dvir
nor in the past few years it's been on
the back page and printed in the same
color text as the back pages which is
usually black so was it fun
it wasn't really that hard to go get it
last year and the previous year's yeah
duck should do some basic decoding and
then we take you on a wild goose chase
throughout the internet to kind of go do
some things this year this year and yes
I actually didn't put the one up here so
you can't really see it but on the back
cover
there's no printed copies of the DBR
this year we went really cheap but on
the back cover there's actually a little
mini waveforms really tiny waveforms
that were actually encoded into each of
the different panels inside here it's a
different stream and you actually this
year had to decode them from the ups and
downs into zeros and ones
you then had to explore them all the way
down and then you had to ASCII decode
them across to get to a bitly link which
then sent you another wild goose chase
off the United including gopher servers
actually this year it's really kind of
funny awesome
[Music]
so actually I wish I could tell you that
so it turned like like we can probably
talk to you about the formal records
perspective but that's kind of hokey
because you know an f-15 Strike Fighter
versus you know a couple hundred pans I
don't care about those um the so and we
don't get really good lost data so the
velocity that we have is actually from
the insurance companies so just using
them as a trend is bad because not
everybody has cyber insurance as well
too so we're still in a bad position to
talk about actual cost every breach over
time port for those kind of things we'd
love to do that but it's not
statistically sound to do that and we
try not to do things that are not
statistically sound anybody else yep mr.
Whitman
oh gosh yes mr. Whitman
yeah actually that's a really great
question so there's other questions I
know we're running over on I want to
that I want to transcend the actual
anakena because it's gonna be all you
guys really need a good was being
awesome actually
I know I I'm part of the organizer so I
know it's in it do you guys need to go I
don't really get excited about that but
it's not Chloe it sort of it so two
things with that so yet we are working
on a data collection platform with
multiple partners including us including
ourselves to enable people to be
recording these things in in a more
frequent way so that's the first thing
is key is getting the data from people
so we need that like that's something we
need first of all we are actually at
least trying to get a mid-year version
of it so that we can actually update
these things and the third thing which
basically is tied to that but I
mentioned it earlier is the way Jay and
I've been talking about it is there are
enough course stats now especially with
the the stuff that we've done over the
past couple years that we can actually
start developing what we would kind of
call the Beige Book of reaches and have
that be the thing that you you know it's
a Facebook is not a great read guys if
you ever seen the Facebook from from the
government it ain't great it's a really
boring read unless you're actually into
that stuff that need to know the
information then it's really awesome
thing so if we can produce that on a
more regular basis and have that release
and court least quarterly if not do more
that can then be the thing that gets
tracked over time as we find a note and
then we didn't notice the things coming
in from there to say yeah that's a
really great question then yeah we're
really trying to do that it's just a
data collection they're really really
hard as you kind of well know from the
stuff that you do and your that this is
your scales with a bigger than our Sun
anything else thank you for your time in
your net interaction
all right so okay well heading to let me
see Empire ballroom first floor