Security lessons from the Sochi Olympics

Overview This talk covers security operations and incident response during the Sochi Olympic Games. The security team managed up to 70 incidents daily while retrofitting security measures into infrastructure that was not originally designed with security in mind. Despite the high incident volume, no breaches were publicly announced.

Key Challenge: The Journalist Factor The speaker emphasizes that 13,000 journalists attending the games created an unexpected security variable. These journalists had built automated monitoring systems for the Olympic infrastructure and could publish articles about security issues within minutes of their occurrence. A DDoS attack lasting only three minutes resulted in article publication within two minutes of the attack start.

Four Major Incidents

1. FTP Server Breach (New Year's Eve): Stolen FTP accounts were being sold for $10,000 per account on hacking forums. The compromised server had improper configuration and direct access to the domain controller. Analysis revealed Wireshark installation, deleted logs, and 50+ compromised accounts including administrative and security officer accounts.

2. Undetected Brazilian Bank Trojan: Using AVZ malware detection technology (which automatically processes logs and quarantines), the team discovered specially crafted malware initially undetected by any antivirus. The same malware appeared in modified form two months later and again one month after that. Analysis revealed it targeted the finance department, stealing banking client accounts, AD credentials, and VPN accounts.

3. Botnet Discovery: During forensics work for another customer, the team found references to Olympic infrastructure IP addresses in botnet configuration files. This led to discovery of three additional botnets, with detailed analysis showing significant data theft and account compromises.

4. Insider Threat (4 AM Incident): A first-line network engineer was discovered conducting suspicious activities including disk wiping tools, cryptography tools, malware tools (Metasploit), and antivirus evasion attempts. Investigation revealed he was a previously convicted attacker (multiple federal website attacks) who had gained employment using false identity and was preparing a serious attack on critical Olympic resources.

Defensive Measures and Results The team deployed multiple APT detection services, cyber intelligence platforms, and AVZ-based automated malware analysis. Overall statistics: 100,000+ malware attacks prevented (primarily trojans and Java exploits) and 2,000+ attacks detected on honeypot systems.

Lessons Learned - Secure by design: integrate security from inception, not retrofit - Invest in quality people and best-in-class tools (Kaspersky Lab technology) - Customer education and building client confidence in expertise is essential