Threats and Solutions for Supply Chain Attacks in IT – DeepSec conference sheds light on the concatenated logistics of information technology.
On the web you can find videos of very sophisticated constructions of many dominoes. If you knock over one domino, a whole cascade of breathtaking actions follows. The domino effect in your own IT infrastructure is much less entertaining. Even there, everything usually begins harmlessly with a small action – reading a message, forwarding a document, accessing a web server or receiving a short message from a supposed employee. It becomes particularly exciting when the dominoes are your own suppliers and business partners. This year’s DeepSec Security Conference offers rich content to analyze the interwoven situation of today’s companies and organizations.
In networks you need to trust
In theory, there is always an outside and an inside. Doors, network filters, access, …. Data management knows this approach. In all IT architectures, therefore, a division always takes place, which ultimately also maps the security zones. Outside often means untrustworthy. Once data, persons or activities have completed a series of security checks, they are considered trustworthy. This condition often remains unchanged because no further or at least fewer tests are performed. Trust is spreading. If you combine these elements through business relationships, you build your own personal street of dominoes. The more complex the processes, the more stones are on the table. A mix of service providers and outsourcing exponentiates the danger. Attackers now only have to pick the right domino to collapse the whole set up.
In the past 12 months, several attacks on suppliers affected the European aviation group Airbus. The group was attacked via smaller companies, apparently exploiting the relationship of trust. Security measures are not equal or the same in every company simply because of the different budgets in organizations. But size can also be deceiving, because the mere presence of data on a cloud platform doesn’t say anything about security. Business life is thus dominated by domino chains, at least from the point of view of information security.
Overview beats size of an organization
No hasty conclusions about supply chains and their importance for security should be drawn now, even if conclusions based on incomplete knowledge are currently fashionable. The size of a company or its budget for security is no guarantee against incidents. Of course, attackers always try to take the most efficient route to reach their destination. With smaller companies, there are many more ways to push the button. The best countermeasure is to clarify your own dependencies and to have a very good eye on them. As mentioned at the beginning, it is not possible to work without trust. Nevertheless, one should start with as few unaudited assumptions as possible when it comes to internal and external trust relationships.
This is why November’s DeepSec IT Security Conference offers a range of training sessions and lectures to help you to better understand your own dominoes. The two-day trainings specifically teach dealing with threats. In his training, Xavier Mertens demonstrates how to recognize threats by analyzing freely available data, to isolate them and to come up with results. In the technical training of Davy Douhine and Guillaume Lopes, mobile devices, in Dawid Czagan’s training, modern web applications are disassembled into their logical components from the point of view of information security Both technologies are part of all domino chains in all sectors of the economy.
Lior Yaari’s device development training for the Internet of Things (IoT) is about pitfalls in product development and testing of IoT components. Arnauld Soullie teaches about weaknesses of Industrial Control Systems, which can be found in industrial plants throughout Europe and around the world. Peter Manev and Eric Leblond provide their expertise in the field of burglary analysis in networks in their training. Both are renowned experts who have been analyzing and detecting traces of attacks and anomalies in data transfers for more than 10 years.
And last but not least, Thomas Fischer and Craig Jones offer their practical experience in dealing with the most important steps in an emergency when a group of attackers has already set foot in your own infrastructure – or that of your supplier. Their training is focused on measures of information gathering, the finding of weak points in the own infrastructure, the course of the break-in and the detection of its traces.
Courage for technical understanding is essential
IT security, like information technology itself, struggles with the complexity of the hardware and software used. When collecting the necessary experience and learning the necessary knowledge, unfortunately, often technical relationships are omitted. However, these are an important tool to be able to correctly assess the technologies used in your own company and among your partners. Today, you may not exactly why a plane flies and how a car drives, but an examination of the respective topics inevitably requires knowledge of the technology. For this reason, the DeepSec conference has been titled In-Depth Security Conference since its founding, because security is always about details, never superficialities. The DeepSec conference attaches great importance to the expertise of trainers and lecturers, and it also supports research and teaching in order to provide new insights to the business community. Take the opportunity and don’t be a domino.
Programs and booking
The DeepSec 2019 conference takes place on 28 and 29 November. The DeepSec trainings will take place on the two previous days, the 26th and 27th of November.
The venue of the DeepSec event is The Imperial Riding School Vienna – A Renaissance Hotel, Ungargasse 60, 1030 Vienna.
Tickets for the DeepSec conference itself and the trainings can be ordered at any time at https://deepsec.net/register.html.