THREAT
(Example target)
NATION STATE
(Gov. agency)
APT
(Card processor)
RANSOMWARE
(Logistics firm)
MIS-CONFIG
(Data backup co.)
INSIDER THREAT
(Healthcare co.)
CAUSES
Unauthorized access, lateral movement
Unpatched vulns, lateral movement
Petya, unpatched, unsecured networks
Free access to cloud server
Overly permissive access
IMPACT
PII of 21.5M federal employees breached
PII of 146M customers breached
$300M loss, 29k systems impacted
Customer data exposed
18,000 medical records exposed
EXPERTS RECOMMEND
US-HCOGR →
"ZERO TRUST MODEL"
Mandiant →
"ENHANCE NETWORK SEGMENTATION"
US CERT →
"... LEAST PRIVILEGE"
OWASP →
"SEGMENTED APPLICATIONS"
Security Metrics →
"NETWORK SEGMENTATION"