making architectural decisions to disrupt the economics of ... · let’s do some math… • cyber...
TRANSCRIPT
![Page 1: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/1.jpg)
Making Architectural Decisions to Disrupt the Economics of Cyber Attacks
Mike Viscuso
CTO at Carbon Black
March 7, 2017
![Page 2: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/2.jpg)
Security products built by security experts
Michael Viscuso
Co-founder & SVP Products
Co-founded Carbon Black in 2011 to
defend against offensive attacks he
personally used
Business-minded technologist with
significant offensive security
experience
Roles at the NSA / defense contractors
• Pentesters
• Incident Responders
• Architecture & Operations
• Malware Analysis & Forensics
• Offensive security
33% of product team have
practitioner experience
I © 2016 Carbon Black. All Rights Reserved. 2
![Page 3: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/3.jpg)
1
2
3
4
5
How Criminals Think About Crime
Business is Booming
Shifting Market Trends
Put Your Black Hat On
Architectural Changes You Can Make
AGENDA
![Page 4: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/4.jpg)
How Do Criminals Think About Crime?
I © 2016 Carbon Black. All Rights Reserved. 4
![Page 5: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/5.jpg)
The Criminal Equation
I © 2016 Carbon Black. All Rights Reserved. 5
![Page 6: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/6.jpg)
The Criminal Equation
What do I get by committing this crime?
I © 2016 Carbon Black. All Rights Reserved. 6
What do I stand to lose if I get caught?
What are the chances I’ll get caught and convicted?
![Page 7: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/7.jpg)
In other words…
What are the net benefits of entering a new market or building a new product?
I © 2016 Carbon Black. All Rights Reserved. 7
What are the opportunity costs of staying with our existing portfolio?
What is the probability of success?
![Page 8: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/8.jpg)
You should start thinking of these people…
I © 2016 Carbon Black. All Rights Reserved. 8
![Page 9: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/9.jpg)
Like these people…
I © 2016 Carbon Black. All Rights Reserved. 9
![Page 10: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/10.jpg)
2
1
Cybercriminals think just like businesses do
I © 2016 Carbon Black. All Rights Reserved. 10
How do I increase revenue potential?
How do I decrease costs and risk?
![Page 11: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/11.jpg)
I © 2016 Carbon Black. All Rights Reserved. 11
Source: RAND / Juniper
![Page 12: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/12.jpg)
Source: RAND / Juniper
I © 2016 Carbon Black. All Rights Reserved. 12
![Page 13: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/13.jpg)
To get some perspective…
Source: RAND / Juniper
I © 2016 Carbon Black. All Rights Reserved. 13
![Page 14: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/14.jpg)
Google’s Income Sheet
I © 2016 Carbon Black. All Rights Reserved. 14
Source: Yahoo Finace
![Page 15: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/15.jpg)
Google Employs 57,000+ Employees
Source: Business Insider
I © 2016 Carbon Black. All Rights Reserved. 15
![Page 16: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/16.jpg)
Let’s do some math…
• Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T)
CC > $2,100,000,000,000
• Cocaine (Coc) is $85B of that illicit drug trade
Coc = $85B
• Google (GOOG) brought in “just over” $90B in revenue in the last 12 months and
employed 57,000 people. Google’s profit (GOOGp) per employee would be:
GOOGp = $90,000,000,000 / 57,000 employees = $1.5M / employee
• Using this info, we can estimate how many people are involved in Cyber Crime
Size of CC (in people) > $2,100,000,000,000 / $1,500,000 = 1,400,000 people
I © 2016 Carbon Black. All Rights Reserved. 16
![Page 17: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/17.jpg)
~1.4 million people involved in cybercrime
It’s more than a business…
I © 2016 Carbon Black. All Rights Reserved. 17
![Page 18: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/18.jpg)
It’s an economy
Source: RAND / Juniper
I © 2016 Carbon Black. All Rights Reserved. 18
![Page 19: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/19.jpg)
I © 2016 Carbon Black. All Rights Reserved. 19
2
1There are more attacks
today than ever
Attacks today are more
sophisticated
Specialization in the cyber black market drives thisSource: Verizon DBIR, 2016
![Page 20: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/20.jpg)
The economics are changing for developers
"You’re basically selling commercial software, like anything else. It needs to be polished and come with documentation. The only difference is that you only sell one license, ever, and everyone calls you evil.“
GrugqBangkok-based security
researcher and exploit broker
I © 2016 Carbon Black. All Rights Reserved. 20
Source: Forbes.com
Approximate pricing, 2012
![Page 21: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/21.jpg)
Android Remote Code Execution (RCE) 0-day
I © 2016 Carbon Black. All Rights Reserved. 21
Source: Forbes.com
Posted June, 2015
12.0455 Bitcoin =
~$7,000 US
![Page 22: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/22.jpg)
Windows Local Privilege Escalation 0-day
I © 2016 Carbon Black. All Rights Reserved. 22
Source: Forbes.com
Posted June, 2015
12.0451 Bitcoin =
~$7,000 US
![Page 23: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/23.jpg)
Like in any market, current trends fade and new ones take their place
I © 2016 Carbon Black. All Rights Reserved. 23
![Page 24: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/24.jpg)
Radamant Ransomware Kit
I © 2016 Carbon Black. All Rights Reserved. 24
One month rental price: $1,000 USD
Average malware price: $10 USDSource: bleepingcomputer.com
![Page 25: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/25.jpg)
I © 2016 Carbon Black. All Rights Reserved. 25
Service Price
Botnet rentals
Direct denial of service (DDoS) $535 for 5 hours a day for one week
Email spam $40 / 20K emails
Web spam $2 / 30 posts
Onshore and offshore hosting - virtual private
servers$6 per month
Bulletproof/fast flux hosting
(VPNs and reverse proxies)$3 per month
Complex Botnets: Features include broadcast
command and control, keylogging, download, and
spam
Examples include…
Zeus/Zbot: $700 for old version, $3,000 for new
Butterfly: $900
Simplified botnets: Features include download and
execute malicious code.
Used primarily for rentals/crime-as-a-service
Examples include…
Bredolab: Starts at $50
Source: Infosec Institute
![Page 26: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/26.jpg)
Botnet rentals
I © 2016 Carbon Black. All Rights Reserved. 26
Source: Infosec Institute
![Page 27: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/27.jpg)
Look familiar?
I © 2016 Carbon Black. All Rights Reserved. 27
Product packaging and
tiered pricingSource: Infosec Institute
![Page 28: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/28.jpg)
Look familiar?
I © 2016 Carbon Black. All Rights Reserved. 28
Upgrades and add-on
featuresSource: Infosec Institute
![Page 29: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/29.jpg)
Look familiar?
I © 2016 Carbon Black. All Rights Reserved. 29
Bulk discounting
Source: Infosec Institute
![Page 30: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/30.jpg)
How do you make money from a $450 botnet rental?
I © 2016 Carbon Black. All Rights Reserved. 30
![Page 31: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/31.jpg)
Get your notebooks out now
I © 2016 Carbon Black. All Rights Reserved. 31
![Page 32: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/32.jpg)
It’s This Easy
I © 2016 Carbon Black. All Rights Reserved. 32
![Page 33: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/33.jpg)
Pick a Target
I © 2016 Carbon Black. All Rights Reserved. 33
![Page 34: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/34.jpg)
For the lazy: Automation through LinkedIn APIs
I © 2016 Carbon Black. All Rights Reserved. 34
Source: LinkedIn Developers Page
![Page 35: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/35.jpg)
Send a Request!
I © 2016 Carbon Black. All Rights Reserved. 35
![Page 36: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/36.jpg)
This isn’t any ordinary request…
I © 2016 Carbon Black. All Rights Reserved. 36
![Page 37: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/37.jpg)
Domain Registration
Valid-Looking Domains
I © 2016 Carbon Black. All Rights Reserved. 37
![Page 38: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/38.jpg)
Domain Registration
For the cost of a Big Mac
I © 2016 Carbon Black. All Rights Reserved. 38
![Page 39: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/39.jpg)
Login to “LinkedIn”
I © 2016 Carbon Black. All Rights Reserved. 39
![Page 40: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/40.jpg)
Enumerate for a Vulnerability I Can Leverage….
I © 2016 Carbon Black. All Rights Reserved. 40
![Page 41: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/41.jpg)
Exploit Executed...
I © 2016 Carbon Black. All Rights Reserved. 41
![Page 42: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/42.jpg)
No vulnerabilities? No problem.
I © 2016 Carbon Black. All Rights Reserved. 42
![Page 43: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/43.jpg)
If I Can Access Your Email….
I © 2016 Carbon Black. All Rights Reserved. 43
![Page 44: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/44.jpg)
I Can Access Your Bank Account...
I © 2016 Carbon Black. All Rights Reserved. 44
![Page 45: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/45.jpg)
And I Most Likely Can Access...
I © 2016 Carbon Black. All Rights Reserved. 45
![Page 46: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/46.jpg)
Reality
I © 2016 Carbon Black. All Rights Reserved. 46
![Page 47: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/47.jpg)
Changing Disruption Methodology
I © 2016 Carbon Black. All Rights Reserved. 47
The traditional economics literature on crime has suggested that increasing the punishment for crime or increasing the probabilities of arrest and conviction would reduce the frequency of crime… [Deterrence] has not, however, exhibited a great deal of historical impact…
“
![Page 48: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/48.jpg)
Case Study: Credit Card Fraud Detection
I © 2016 Carbon Black. All Rights Reserved. 48
2007
Source: Rolling Stone Magazine
![Page 49: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/49.jpg)
Case Study: Credit Card Fraud Detection
I © 2016 Carbon Black. All Rights Reserved. 49
2007
2015
Source: Rolling Stone Magazine
Source: McAfee
98.3%Reduction in price per
credit card number
![Page 50: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/50.jpg)
I © 2016 Carbon Black. All Rights Reserved. 50
We’ve all experienced why.
![Page 51: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/51.jpg)
Evaluates each transaction
relative to all past activity,
identifying unusual
attributes
Contacts user or denies
card in real time if activity is
suspicious
Records every transaction and
runs through a central
analytics engine
Correlation occurs across all
cards with similar attributes to
preempt future fraud
EVENT
STREAM
PROCESSING
The TECHNOLOGY Behind Fraud Detection
I © 2016 Carbon Black. All Rights Reserved. 51
![Page 52: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/52.jpg)
How it was done before…
I © 2016 Carbon Black. All Rights Reserved. 52
Agents sift through a daily report to uncover fraud
Source: StreamBase Blog
![Page 53: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/53.jpg)
How it happens today
I © 2016 Carbon Black. All Rights Reserved. 53
Fraud is detected within milliseconds
Source: StreamBase Blog
![Page 54: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/54.jpg)
I © 2016 Carbon Black. All Rights Reserved. 54
This is exactly how you are going to change your architecture to prevent cybercrime.
![Page 55: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/55.jpg)
OLD SYSTEM
Scanning through a daily report to spot fraud
NEW SYSTEM
Real-time fraud detection and response
I © 2016 Carbon Black. All Rights Reserved. 55
![Page 56: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/56.jpg)
Traditional
Antivirus
• Point-in-time prevention
• Evaluates individual files
• Stops known malware only
Next-Generation
Antivirus
• Streaming prevention
• Evaluates event sequences
• Stops malware and non-malware
I © 2016 Carbon Black. All Rights Reserved. 56
![Page 57: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/57.jpg)
MACHINE-LEARNING AV
FILES ONLY
STREAMINGPREVENTION
FILES + ATTACKS
LEGACY AV
FILES ONLY
I © 2016 Carbon Black. All Rights Reserved. 57
![Page 58: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/58.jpg)
MALWARE + NON-MALWARE PROTECTION
NON-MALWARE ATTACKS ON THE RISE
47%OF BREACHES USE
MALWARE
53%OF BREACHES ARE
NON-MALWARE
MALWARE ATTACKS NON-MALWARE ATTACKS
KNOWN UNKNOWN RANSOM OBFUSCATED MEMORY MACROS REMOTE
LOGIN
POWERSHELL
I © 2016 Carbon Black. All Rights Reserved. 58
![Page 59: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/59.jpg)
SANS: Defining Next-Generation Antivirus (NGAV)
1. Prevent malware attacks
2. Prevent non-malware attacks
3. Detection and response
4. Context and visibility
I © 2016 Carbon Black. All Rights Reserved. 59
![Page 60: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/60.jpg)
Gartner Agrees
I © 2016 Carbon Black. All Rights Reserved. 60
Competitive Landscape: Endpoint Detection and Response ToolsJanuary 5, 2017Note: Graphic was created using data from Gartner’s 3Q16 information security Forecast and Competitive Landscape estimates.
Source: Gartner (January 2017)
EPP with EDR
![Page 61: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/61.jpg)
Next-Generation Antivirus
VISIBILITYRecords every endpoint event and analyzes event sequences in real time
I © 2016 Carbon Black. All Rights Reserved. 61
![Page 62: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/62.jpg)
Next-Generation Antivirus
DETECTIONIdentifies irregular event sequences by matching against “normal” ones; collates data from every endpoint to increase accuracy
I © 2016 Carbon Black. All Rights Reserved. 62
![Page 63: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/63.jpg)
Next-Generation Antivirus
PREVENTIONAlerts admins of suspicious behaviors; automatically prevents any event when its risk exceeds acceptable thresholds
I © 2016 Carbon Black. All Rights Reserved. 63
![Page 64: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/64.jpg)
Next-Generation Antivirus
RESPONSEVisualizes the attack chain to uncover point-of-entry; helps you identify and implement patches or compensating controls
I © 2016 Carbon Black. All Rights Reserved. 64
![Page 65: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/65.jpg)
OUR VIEWPOINTCb Defense converges prevention, detection and response
1. Prevent malware attacks
2. Prevent non-malware attacks
3. Detection and response
4. Context and visibility
I © 2016 Carbon Black. All Rights Reserved. 65
![Page 66: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/66.jpg)
Next-Generation Antivirus
What you can expect
I © 2016 Carbon Black. All Rights Reserved. 66
Acceleration in
time to respond
Prevention
coverage
Reduction in time
to detect a breach
Reduction in
re-imaging needs
98.8% 99% 99.3% 100%
![Page 67: Making Architectural Decisions to Disrupt the Economics of ... · Let’s do some math… • Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T) CC > $2,100,000,000,000](https://reader035.vdocuments.us/reader035/viewer/2022062414/5f0ad81c7e708231d42d9e03/html5/thumbnails/67.jpg)
THANKS
Follow us!
@MichaelViscuso
@CarbonBlack_Inc
I © 2016 Carbon Black. All Rights Reserved. 67