How you doing? My name is be bragging with Cfo online. I'm here at the thin air booth at blackhat
We're going to talk about asset tracking and data
So as I said I'm here at the thin air booth
Why don't you tell everybody who you are and what we're going to look at today?
Sure, I'm tony Gotha Founder and ceo of thin air
We've invented a new technology that allows you to basically do what we like to call information
Attribution and what that means is that we can tell you every single person within your organization that's ever seen a particular piece of information
And why that's important is that in the event that information is leaked or stolen from the organization?
We can tell you within about 90 seconds who the actual leaker within the organization was that's our superpower
So I first came across thin air during the rSA show earlier this year and there were some things about it that
Stood out to me as many of you
Who've read me or seen me speak know I'm a red teamer at heart, but I also do really support the blue Team's initiative, especially
Anything that happens during internet response?
I'm a big fan of that
and
when I saw their demo the thing that stood out to me was if I'd have had that ten maybe
Fifteen years ago when I was still working in it, my life would have been a lot simpler
It would have been so much easier now for those of you not familiar with thin air the easiest way to think of them is
It's like google, but the only thing they really care about is the data itself
It doesn't matter who's accessing what or where it lives because they know all that
What they're going to be able to do is tell you who's got access to your data when they had access to it
Why they had access to it how they had access to it where it went and then if it went somewhere else they could tell
You who it went to and then from there?
You can drill down further well the person that went to now has access to all of this and they've been here
it's an amazing mind map of
Where all of your digital trails are on the network and what stood out to me during the demo?
I saw in California was the fact that it finds things you didn't know existed on your network
and that's actually really critical considering that a lot of times a
Enterprise experiences a Data breach writ
Incident itself with things they didn't know where there, and that could be a big problem, especially a heavily regulated industry
So what we're going to do today is we're going to walk you through some of the nares product
We're actually going to show what got me so excited
Earlier this year because anybody who watches knows I don't talk about products
And I don't promote vendors unless they've done something that really really gets my attention. Let's start with the basics. Show me. What a general
Outlook or a general view looks like on a given network sure so I'm going to show you a very particular example
Which is let's say that there is a financial institution that has a credit card number that they believe was compromised
so the question is
How did this credit card number get compromised so normally when you do it in an investigation you start?
What we like to call tangental indicators of compromise so things like
Anomalous Network behavior your malware systems tripped and it gave you an alert what there it's actually quite different
What we do is we start an investigation with the content that was actually taken from the organization
That's how we start let me show you exactly how that works, so
What we have here is a simple as our console our console itself is model. It looks very familiar
Which is like a google except when you type things into google what they do is if they give you the relevant?
Results based on the type if it's a you know if it's a particular keyword, it'll find
like the news
videos images that are similar to those particular keywords
Both in air does something that's very similar that except when you type in content with this than air
We find other we find basically all the indices that did anomalous things
But that content itself let me show you exactly how that works, so
Here in our particular scenario. We know there's a credit card number dell is compromised
What I'd like to do is just type that credit card number into thin air to start the investigation
What thin air does is goes out and finds every single file that ever had this credit card number?
within it
Every person that ever saw this credit card number every device that ever had this credit card number on it
Every network this credit card number was communicated through and every application that ever touched this particular credit card number
So in this very particular case there is one credit card number this inside this particular file called Pii Data
What I'd love to do is it this file to see what else is inside of this file?
So inside of this file, and I do that just by clicking on the file name itself
So you'll notice that not only this particular credit card number inside of this file, but there's about 2,500 other credit card numbers
there's about 2,500 other social security numbers and even
2,700 email address so thin air does this automatically the moment that you deploy within your environment we also do other
Business critical things like in the event that this particular fire actually gets stolen
We can even do things like calculate the compliance cost based on the industry so let's say if you're a technology company
We can tell you very quickly
Exactly how much of applying you would to incur if this particular file was actually?
Excellent rated from the organization now if we know that this particular credit card number is in this file
The question is how did it actually leave the organization? So we're going to do something very simple?
I'm actually going to pivot to see every single application that ever touched this file historically
I remember the thing about veneers that we keep
Every single time someone touches information is soaring into perpetuity and what's great about that is that in the event this information again becomes
Compromised we can we can quickly try to pattern match against and find the folks that were most likely to do it
So here's a list of every single application now. This is this is a few. This is maybe more than ten
I don't want to do something simple what I want to do is just reduce the amount of information out to here by doing
By getting rid of all the system process
So now we have three results. So there's Vmware tools that touch this particular credit card number. There's Microsoft excel then
There's also explorer Malwan. That's a very interesting processing
I'd love to know more about that particular process, so the back story to explore Malware
Is that it is actually not malware there was an insider within the organization that wrote a python script to excellent read this information
And he named it this to throw off the incident responders, so they would think this was actually malware, but actually it's an insider
So what I'd love to know is that since this file actually did take that one excel spreadsheet that we talked about the question
What else did it touch? What else did it actually take?
So we started out with one credit card number we see that
There's about 2,500 credit card numbers inside the file that was compromised
But the question is what else did it take so let's pivot to that
click there
remove this and
Now you see instead of it being one file that was compromised
There were 74 files across two different people across two different devices
And you'll notice that instead of it being just 2,400 credit card numbers you'll actually actually see it's about
24,000 we did this in about three clicks and you notice the compliance cost for this or for this particular breach
Just went to about two million dollars
I did all this in three clicks and actually I think that's too much
I think ninety seconds is too long for us to figure out where insiders are so we invented a new technology
We call it a moment. What moments does is literally do everything
I just did except automatically behind the scene so alot to do is click this button
And then every will literally tell you exactly
How the breach occurred within the organization based in the context of the information that you're searching?
That's what we do
This is why I say if only I had the 10 to 15 years ago life would have been so much better
So a quick question about the the calculated cost where are you pulling those figures from these are standard point Iman institute?
Estimated numbers, and what's great about there?
Is that we know literally every single data element that exists throughout the suite so we can very easily?
calculate the exact cost that a particular file or group Profiles or device or even a
person could inflict against the organization in the event they were to move to a competitor or
exfiltrated information from the organization within seconds
So let's talk about the agent itself where we're collecting all of this data and able to the track
Where can we put the age it's a it's a very lightweight sensor. That's deployed across your endpoint
What we do is that we collect that information as information being accessed
And we attribute that information to a person it's about 10 megabytes worth its limit, Ori, that's it to a cloud manage
Sir where we then give you the ability to do these investigations now what we don't do is
Store all the sensitive information in the cloud we just store the Metadata around how information is being accessed
what's great about that is is that allows us to answer these types of questions very quickly for your organization, so
Let's let's go back to like some of the earlier earlier customers and trials. You did as you were coming
Forward in the market sure what was one of the most jaw-dropping
Frightening things that customers ever seen after letting this run for a little bit. Yes
So we literally deploy to a multinational consulting company that was concerned about insiders within their organization
Stealing information from the company so we deployed in air within the first two hours
We caught the first insight and what they were doing. Is that this is a consulting company that has a database. That's very sensitive
They were stealing that database and setting up competing companies
against the against the company that they work for
We found the first inside of the first two hours within the next 48 we found two more
alrighty then, that's good, so
what's next where do you take this one here our super power is helping analyst get to the answer as
Quickly as possible what we don't want to do is give you more alerts more reports those are things we can do
But we're focused on answering the question that your organization has what is the impact of this?
What is the source of this breach and what do I need to do in my network to protect it in the future?
So what's great about there?
Is that we give you complete visibility and that visibility can be used to augment your existing security technologies?
We are not a dlp replacement. We're not a kasseri replacement
We make your existing
Dlp
Technologies better because we tell you everything that it's been admits you make your existing cap needs employment better because we tell you everything that
It missed as well. We make your existing security investment better
Once again, this is tony from thin air. We're at the thin air booth here at blackhat
If you'd like to learn more about them go to thin air comm if you'd like to learn more about insider threats
incident response or any other type of
Fascinating security topic that yours truly will be bringing about feel free to look us up at csO online.com and again
My name is Steve Regan