You are viewing content from a past/completed QCon

Presentation: Security & Psychology: Demotivating Persistent Threats

Track: Security: Lessons Attacking & Defending

Location: Pacific DEKJ

Duration: 10:35am - 11:25am

Day of week: Wednesday

Slides: Download Slides

Level: Intermediate

Persona: Architect, Developer, Security Professional

Share this on:

This presentation is now available to view on InfoQ.com

Watch video with transcript

Abstract

Preventing advanced cybercriminals from accessing and exploiting your most sensitive data requires more than just a strong threat detection infrastructure — it demands a personal understanding of the attackers themselves. Once an attack group’s motivations are identified you can start generating a profile and persona that will make disincentivizing them a whole lot easier. Without this added layer of psychological analysis, you will find yourself addressing incident after incident with no end in sight. 

At the core, an actor’s intent is always the same - motivated people with economic justification for their actions are committing large-scale attacks because their livelihood depends on it. It’s up to you to disrupt those economics so they move to softer targets. 

In this session, Shape Security Director of Engineering Jarrod Overson will break down the workflow for effective threat mitigation of sophisticated attackers into four distinct stages: 

  • Stage 1) Classification. Look at how can traffic be bucketed into distinct segments that define individual actors or groups. 
  • Stage 2) Research and generate an actor profile. Understand what these actors are getting out of these attacks, and form some hypotheses from their attack characteristics. Are they data resellers? Developers? Independent actors or full-time employees? What hours are they active? How quickly do they respond to mitigation? This actor profile will help define the approach in Stage 3.
  • Stage 3) Counter attack. Develop and deploy countermeasures that target the attack in a way that drives up cost while reducing value. Play with them, target the damage on their off hours, give sporadic and variable feedback. Increasing the psychological cost is a damage multiplier.
  • Stage 4) Rinse & repeat until all threats are cleared. This is only temporary, of course. As long as value remains then new attackers will fill the vacuum and each subsequent attack will be more sophisticated than the last. Relentless, targeted responses will eventually wear away the motivation to continue the attack. 

Jarrod has seen traffic from individual attackers, coordinated groups, state actors, and more - all of which require different approaches. Sophisticated threats rarely engage in attacks for no reason - understand where the money is coming from and the motivations behind an attack and you can disrupt the attackers with greater force.

Speaker: Jarrod Overson

Engineering Director @ShapeSecurity & JavaScript Expert

Jarrod has been developing on the web for over 15 years in both startups and global companies and currently works at Shape Security. Previously at Riot Games and Napster, Jarrod has worked in every corner of web technology and is an active proponent and contributor to open source, creator of Plato and co-author of Developing Web Components.

Find Jarrod Overson at

2020 Tracks

  • Clientside: From WASM to Browser Applications

    Dive into some of the technologies that can be leveraged to ultimately deliver a more impactful interaction between the user and client.

  • Languages of Infra

    More than just Infrastructure as a Service, today we have librarys, languages, and platforms that help us define our infra. Languages of Infra explore languages and libraries being used today to build modern cloud native architectures.

  • Mechanical Sympathy: The Software/Hardware Divide

    Understanding the Hardware Makes You a Better Developer

  • Paths to Production: Deployments You've Always Wondered About

    Deployment pipelines allow us to push to production at ever increasing volume. Paths to production looks at how some of software's most well known shops continuous deliver code.

  • Java, The Platform

    Mobile, Micro, Modular: The platform continues to evolve and change. Discover how the platform continues to drive us forward.

  • Security for Engineers

    How to build secure, yet usable, systems from the engineer's perspective.

  • Modern Data Engineering

    The innovations necessary to build towards a fully automated decentralized data warehouse.

  • Machine Learning for the Software Engineer

    AI and machine learning is more approachable than ever. Discover how ML, deep learning, and other modern approaches are being used in practice by Software Engineers.

  • Inclusion & Diversity in Tech

    The road map to a inclusive and diverse tech organization. *Diversity & Inclusion defined as the inclusion of all individuals in an within tech, regardless of gender, religion, ethnicity, race, age, sexual orientation, and physical or mental fitness.

  • Architectures You've Always Wondered About

    How do they do it? In QCon's marquee Architectures track, we learn what it takes to operate at large scale from well-known names in our industry. You will take away hard-earned architectural lessons on scalability, reliability, throughput, and performance.

  • Architecting for Confidence: Building Resilant Systems

    Your system will fail. Build systems with the confidence to know when they do, you won't.

  • Remotely Productive: Remote Teams & Software

    More and more companies are moving to remote work. How do you build, work on, and lead teams remotely?

  • Operating Microservices

    Building and operating distributed systems is hard, and microservices are no different. Learn strategies for not just building a service but operating them at scale.

  • Distributed Systems for Developers

    Computer science in practice. An applied track that fuses together the human side of computer science with the technical choices that are made along the way

  • The Future of the API: REST, gRPC, GraphQL and More

    Web-based API continue to evolve. The track provides the what, how, and why of future APIs, including GraphQL, Backend for Frontend, gRPC, & ReST

  • Resurgence of Functional Programming

    What was once a paradigm shift in how we thought of programming languages is now main stream in nearly all modern languages. Hear how software shops are infusing concepts like pure functions and immutablity into their architectures and design choices.

  • Social Responsibility: Implications of Building Modern Software

    Software has an ever increasing impact on individuals and society. Understanding these implications helps build software that works for all users

  • Non-Technical Skills for Technical Folks

    To be an effective engineer, requires more than great coding skills. Learn the subtle arts of the tech lead, including empathy, communication, and organization.