First Annual Risk Conference 2023
What it is about
Presentation from the First Annual Risk Conference (September 2023) on how cybersecurity risks are managed, from the Dominican regulatory framework to threat intelligence-based defense. The presentation is marked as restricted circulation (TLP: amber).
The 46 slides follow six blocks: regulatory aspects, main risks and threats, managing risks and threats, management architecture and defense schemes, tactics, techniques and procedures (TTPs) applied to cyber defense, and best practices for acting on TTPs. It includes models such as MITRE ATT&CK, the Diamond Model, the Cyber Kill Chain and F3EAD.
Objectives
- Review the responsibilities and regulatory requirements in cybersecurity and information security risk management.
- Present the main threats and how they materialize, with examples such as phishing and the Mirai botnet.
- Show how to move from reacting to indicators of compromise to defending based on attackers' tactics, techniques and procedures.
Key takeaways
- The regulatory framework requires governance, technology risk management, information asset management, security infrastructure, vulnerability management and event logging.
- Distinguishing data, information and intelligence allows what is collected to be turned into defense decisions.
- TTPs describe an attacker's way of operating and are the hardest thing for them to change; acting on them therefore protects against more variants than blocking an IP address or a hash.
- David Bianco's "pyramid of pain" orders indicators from the most trivial (hashes, IP addresses) to the hardest for the adversary to change (TTPs).
- Mature defense combines passive defense (firewalls, antivirus), active defense (monitoring, incident response, SOC) and intelligence, supported by MITRE ATT&CK to choose courses of action.
Connect with our networks