IBM Security QRadar
- 1. © 2016 IBM Corporation Sense & Act On Cyberthreats With the Most Advanced Security Analytics Platform IBM Security QRadar
- 2. © 2016 IBM Corporation CTO Discussion SANDY BIRD IBM Fellow Chief Technology Officer IBM Security
- 3. 3© 2016 IBM Corporation CISO Challenge: Devising the right security strategy Predict Business Risk Detect Insider Threats Consolidate & Protect Data Identify Threats Stay Compliant
- 4. 4© 2016 IBM Corporation Upon close, Resilient Systems will advance the IBM Security strategy to help organizations succeed in an era of escalating cyber attacks Unites Security Operations and Incident Response Resilient Systems will extend IBM’s offerings to create one of the industry’s most complete solutions to prevent, detect, and respond to threats Delivers a Single Hub for Response Management Resilient Systems will allow security teams to orchestrate response processes, and resolve incidents faster, more effectively, and more intelligently Integrates Seamlessly with IBM and Third-Party Solutions Resilient Systems integrates with QRadar and other IBM and third-party solutions so organizations of various sizes can successfully resolve attacks PREVENTION DETECTION RESPONSE Help to continuously stop attacks and remediate vulnerabilities Identify the most important threats with advanced analytics and forensics Respond to incidents in integrated and organized fashion
- 5. 5© 2016 IBM Corporation LegalHR CEO CISO IT Upon close, IBM Security will have the industry’s first integrated end-to-end Security Operations and Response Platform IDS NIPS AV DBs AppsDLP FW ... Security Operations and Response Platform NEW! Resilient Systems Incident Response IBM QRadar Security Intelligence Vulnerability and Patch Management Endpoint / Network Threat Detection and Forensics Entity and Insider Threat Analytics Security Operations and Incident Response Services IBM X-FORCE EXCHANGE automatically updates incident artifacts with threat intelligence IBM QRADAR SECURITY INTELLIGENCE discovers advanced threats and starts the response process IBM SECURITY SERVICES delivers operations consulting to help implement processes and response experts when something goes wrong IBM BIGFIX AND NETWORK FORENSICS enables analysts to query endpoints and analyze traffic Tomorrow’s response is intelligent and coordinated NEW! RESILIENT SYSTEMS INCIDENT RESPONSE generates a response playbook and coordinates activity IBM SECURITY APP EXCHANGE provides apps and add-ons for a rapid and decisive response
- 6. © 2016 IBM Corporation Anticipate the unknown. Sense it and act. MATTHEW CARLE Product Manager – QRadar IBM Security The Power of Security Analytics
- 7. 7© 2016 IBM Corporation 2013 800+ Million records breached 2014 1+ Billion records breached 2015 Unprecedented high-value targets breached Attackers break through conventional safeguards every day $6.5M average cost of a U.S. data breachaverage time to detect APTs 256 days V2016-2-11
- 8. 8© 2016 IBM Corporation Detect attacks disguised as normal activity Retailer POS systems Retailer Windows file server INTERNAL NETWORK Attacker phishes a third-party contractor1 Attacker FTP servers (external) Contractor portals Attacker uses stolen credentials to access contractor portals 2 Attacker finds and infects internal Windows file server 3a Attacker finds and infects POS systems with malware3b Malware scrapes RAM for clear text CC stripe data 4 Stolen data is exfiltrated to FTP servers 5 Advanced Specific Stealthy Exploits human vulnerabilities Targets business process weaknesses
- 9. 9© 2016 IBM Corporation Sense Analytics Threat Detection One Platform, Unified Visibility The Power to Act–at Scale Behavioral Contextual Temporal Extensible Scalable Easily deployed Prioritization Collaboration of threat data Automated response IBM Security QRadar – Success Factors
- 10. 10© 2016 IBM Corporation Advanced analytics assisting in threat identification QRadar is the only Security Intelligence Platform powered by the advanced Sense Analytics engine to: Detect abnormal behaviors across users, networks, applications and data Discover current and historical connections, bringing hidden indicators of attack to the surface Find and prioritize weaknesses before they’re exploited QRadar Sense Analytics™
- 11. 11© 2016 IBM Corporation QRadar Sense Platform Advanced Threat Detection Insider Threat Detection Risk & Vulnerability Management Fraud Detection Incident Forensics Compliance Reporting Securing Cloud USE CASES ACTION ENGINE COLLECTION DEPLOYMENT MODELS Behavior-Based Analytics PRIORITIZED INCIDENTS Context-Based Analytics Time-Based Analytics QRadar Sense AnalyticsTM Third-Party Usage Automation WorkflowsDashboards Visualizations ON PREM AS A SERVICE CLOUD HYBRID Business Systems Cloud Infrastructure Threat Intel Applications Capability and Threat Intelligence Collaboration Platforms App Exchange X-Force Exchange
- 12. 12© 2016 IBM Corporation Prioritized incidents Consume massive amount of structured and unstructured data Incident identification • Extensive data collection, storage, and analysis • Real-time correlation and threat intelligence • Automatic asset, service and user discovery and profiling • Activity baselining and anomaly detection Embedded Intelligence QRadar Sense AnalyticsTM Servers and mainframes Data activity Network and virtual activity Application activity Configuration information Security devices Users and identities Vulnerabilities and threats Global threat intelligence EXTENSIVE DATA SOURCES
- 13. 13© 2016 IBM Corporation Advanced threat detection SCENARIO 1. Host visits malicious domain, but firing an alert might be premature 2. New beaconing behavior 3. Data transfers inconsistent with behavioral baselines appear SCENARIO Sudden change in network traffic The appearance of a new application on host or termination of a typical service are captured as anomalies Pattern identification Anomaly detection User and entity profiling QRadar combines all three conditions to produce a single, heightened alert QRadar senses and discovers by monitoring and profiling assets and individuals
- 14. 14© 2016 IBM Corporation Insider threat monitoring SCENARIO Service rep downloads twice the normal amount of client data – Might be part of new sales analysis activity QRadar knows that service rep was recently laid off and sees data being sent to an external site Business context Historical analytics Risk-based analytics QRadar profiles assets and individuals to help security teams better interpret network context and reduce false-positive results, while fine-tuning the detection of attacks and breaches
- 15. 15© 2016 IBM Corporation Forensics investigation SCENARIO SOC analyst investigating offense discovers employees exposed to phishing scam Attacker has latched-on and expanded to an internal server using pattern identified by X-Force known to inject remote-access Trojan (RAT) software Real-time analytics External threat correlation Statistical analysis QRadar recovers all associated network packets with a few mouse clicks • Pinpoints where and when RAT software installed • Rich profile of malicious software including link analysis identifies “patient zero” and other infected parties • Incident response and remediation is completed with no recurrences
- 16. 16© 2016 IBM Corporation Complete clarity and context QRadar easily deploys lightening fast to help users consolidate insights in a single platform: Delivers scale collecting billions of events on-premises or in the cloud Unifies real-time monitoring, vulnerability and risk management, forensics, and incident response Deep and automated integration from hundreds of third-party sources One platform with global visibility
- 17. 17© 2016 IBM Corporation Visualize your threat landscape
- 18. 18© 2016 IBM Corporation Leverage multiple threat intelligence sources Pull in Threat Intelligence through open STIX/TAXII format Load threat indicators in collections into QRadar Reference sets Use reference sets for correlation, searching, reporting Create custom rule response to post IOCs to Collection USE CASE Bring watchlists of IP addresses from X-Force Exchange create a rule to raise the magnitude of any offense that includes the IP watchlist IBM Security Threat Intelligence
- 19. 19© 2016 IBM Corporation Add collaborative defenses – App Exchange A New Platform for Security Intelligence Collaboration Single collaboration platform for rapidly delivering new apps and content for IBM Security solutions Enable rapid innovation Single platform for collaboration Access partner innovations Validated security apps Allows QRadar users and partners to deploy new use cases in an accelerated way Quickly extend QRadar functionality
- 20. 20© 2016 IBM Corporation Actionable security intelligence QRadar enables security experts within and across organizations to collaboratively take action: Intelligent incident prioritization Collaboration of threat data and security capabilities from X-Force Exchange and App Exchange Resilient incident response with workflow, play groups, collaboration, regulatory requirements, integrations, streamlining and automating incident response remediating threats quickly and with ease The power to act at scale
- 21. 21© 2016 IBM Corporation Global Threat Intelligence Consulting Services | Managed Services Expand the value of security solutions through integration QRadar Risk Manager QRadar Incident Forensics SiteProtector Network Protection XGS Key Lifecycle Manager Guardium zSecure BigFix Trusteer Apex MobileFirst Protect (MaaS360) Trusteer Mobile Trusteer Rapport Trusteer Pinpoint IBM Security Research Identity Manager Access Manager Identity Governance and Intelligence Privileged Identity Manager DataPower Web Security Gateway AppScan Security Intelligence Cloud Cloud Security Enforcer QRadar SIEM QRadar Vulnerability Manager QRadar Log Manager
- 22. © Copyright IBM Corporation 2016. All rights reserved. The information contained in these materials is provided for informational purposes only, and is provided AS IS without warranty of any kind, express or implied. IBM shall not be responsible for any damages arising out of the use of, or otherwise related to, these materials. Nothing contained in these materials is intended to, nor shall have the effect of, creating any warranties or representations from IBM or its suppliers or licensors, or altering the terms and conditions of the applicable license agreement governing the use of IBM software. References in these materials to IBM products, programs, or services do not imply that they will be available in all countries in which IBM operates. Product release dates and / or capabilities referenced in these materials may change at any time at IBM’s sole discretion based on market opportunities or other factors, and are not intended to be a commitment to future product or feature availability in any way. IBM, the IBM logo, and other IBM products and services are trademarks of the International Business Machines Corporation, in the United States, other countries or both. Other company, product, or service names may be trademarks or service marks of others. Statement of Good Security Practices: IT system security involves protecting systems and information through prevention, detection and response to improper access from within and outside your enterprise. Improper access can result in information being altered, destroyed, misappropriated or misused or can result in damage to or misuse of your systems, including for use in attacks on others. No IT system or product should be considered completely secure and no single product, service or security measure can be completely effective in preventing improper use or access. IBM systems, products and services are designed to be part of a lawful, comprehensive security approach, which will necessarily involve additional operational procedures, and may require other systems, products or services to be most effective. IBM DOES NOT WARRANT THAT ANY SYSTEMS, PRODUCTS OR SERVICES ARE IMMUNE FROM, OR WILL MAKE YOUR ENTERPRISE IMMUNE FROM, THE MALICIOUS OR ILLEGAL CONDUCT OF ANY PARTY. THANK YOU www.ibm.com/security
- 23. Information concerning non-IBM products was obtained from the suppliers of those products, their published announcements or other publicly available sources. IBM has not tested those products in connection with this publication and cannot confirm the accuracy of performance, compatibility or any other claims related to non-IBM products. Questions on the capabilities of non-IBM products should be addressed to the suppliers of those products. IBM does not warrant the quality of any third-party products, or the ability of any such third-party products to interoperate with IBM’s products. IBM EXPRESSLY DISCLAIMS ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. The provision of the information contained herein is not intended to, and does not, grant any right or license under any IBM patents, copyrights, trademarks or other intellectual property right. Other company, product, or service names may be trademarks or service marks of others. A current list of IBM trademarks is available at “Copyright and trademark information” www.ibm.com/legal/copytrade.shtml Copyright © 2016 by International Business Machines Corporation (IBM). No part of this document may be reproduced or transmitted in any form without written permission from IBM. U.S. Government Users Restricted Rights – Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM. Information in these presentations (including information relating to products that have not yet been announced by IBM) has been reviewed for accuracy as of the date of initial publication and could include unintentional technical or typographical errors. IBM shall have no responsibility to update this information. THIS document is distributed "AS IS" without any warranty, either express or implied. In no event shall IBM be liable for any damage arising from the use of this information, including but not limited to, loss of data, business interruption, loss of profit or loss of opportunity. IBM products and services are warranted according to the terms and conditions of the agreements under which they are provided. Any statements regarding IBM’s future direction, intent or product plans are subject to change or withdrawal without notice. Performance data contained herein was generally obtained in a controlled, isolated environments. Customer examples are presented as illustrations of how those customers have used IBM products and the results they may have achieved. Actual performance, cost, savings or other results in other operating environments may vary. References in this document to IBM products, programs, or services does not imply that IBM intends to make such products, programs or services available in all countries in which IBM operates or does business. Workshops, sessions and associated materials may have been prepared by independent session speakers, and do not necessarily reflect the views of IBM. All materials and discussions are provided for informational purposes only, and are neither intended to, nor shall constitute legal or other guidance or advice to any individual participant or their specific situation. It is the customer’s responsibility to insure its own compliance with legal requirements and to obtain advice of competent legal counsel as to the identification and interpretation of any relevant laws and regulatory requirements that may affect the customer’s business and any actions the customer may need to take to comply with such laws. IBM does not provide legal advice or represent or warrant that its services or products will ensure that the customer is in compliance with any law. Legal notices and disclaimers