Journey to the Center of Security Operations
- 1. JOURNEY TO THE CENTER OF SECURITY OPERATIONS SERGEJ EPP Chief Security Officer, Central Europe
- 2. FRANKFURT, GERMANY 2 | © 2019 Palo Alto Networks, Inc. All Rights Reserved. SERGEJ EPP Chief Security Officer, Central Europe § Regional Cybersecurity Strategy and Operations § Thought Leadership Global Head of Cyber Forensics & Investigations Global Head of Cyber Hygiene Operations § Endpoint Detection Response § Fraud & Insider Investigations § Firmware and Supply Chain Forensics § Configuration Management, Neutral Control Global Head of Cyber Defense Center § Threat Intelligence § Threat and Forensics Response § Red Team § Cyber Analytics & Big Data § Security Awareness and Roadshows WHOAMI
- 3. EVOLUTION OF INFORMATION SECURITY OPERATIONS 3 | © 2019 Palo Alto Networks, Inc. All Rights Reserved. NOC Compliance SOC Threat-Intel Driven SOC Integrated SOC Fusion Center Level 1 Perimeter focused operations Level 2 SIEM based, Policy driven operations and static playbooks Level 3 Threat-Intelligence focused security operations Level 4 Integrated detection, incident response, forensics, intelligence and vulnerability functions Level 5 Integrated non- cybersecurity functions such as physical security, fraud or business operations
- 4. 4 | © 2019 Palo Alto Networks, Inc. All Rights Reserved. USE CASE
- 5. 5 | © 2018, Palo Alto Networks. All Rights Reserved. We have not responded to an intrusion using a ZeroDay exploit in the last 24 months - National Security Agency* * RSA Conference 2019 “ ”
- 6. GROW YOUR RISK MANAGEMENT 6 | © 2019 Palo Alto Networks, Inc. All Rights Reserved. § Connected vehicle (air/rail/car) threats § Quantum computing § Data exfiltration in the cloud § Cyber Hygiene § AI voice fraud § AI phishing § AI chatbots § Firmware implants § Destructive threats § ID mass blackmailing § OT/IoT Threats § Insider Threat § Third Party Threat § Spyware § Identity theft § Ransomware Virus § AI Exploit Fuzzing § AI Malware Gen. § Biometrics loss § CEO Fraud § Compromised patch control § Crimeware-as-a- service § Phishing § Supervisory Oversight § BYOD threats § Attack obfuscation § Denial of Service § Banking Malware § Advanced regulations § Cryptojacking 10 mio 5 mio 1 mio 100k 10k 1% 2% 5% 10% 20% VULNERABILITIES AND MISCONFIGURATIONS IF YOU CAN FIX ONLY 1/10 OF YOUR VULNERABILITIES, WHICH ONES WILL YOU FIX? CVE-2017-0143 (aka EternalBlue) • Security risk = CVSS 9.3 High • Business risk = Critical • Change risk = Medium
- 7. 7 | © 2019 Palo Alto Networks, Inc. All Rights Reserved. USE CASE
- 8. HYPE CYCLE REACTIVE PREVENTIVE 80% of Enterprises IT investment in security* 72% of VC investments in security startups** *Source: VmWare Analysis ** Cyber Defenders Report, CB Insights 2019
- 9. 9 | © 2018, Palo Alto Networks. All Rights Reserved. BURDEN TO TRIAGE IS STILL A PROBLEM A Tier concept makes sense when the symptoms are well understood. In cybersecurity, we ask the most unexperienced analyst in Tier1 to identify APT attacks. Are you surprised this does not work? TIER 1 TIER 2 TIER 3 106.887.657.123 37% Manual alert enrichment (e.g. checking IP in database)* The Definition of SOC-cess? SANS 2018 Security Operations Center Survey 34% Mostly automated alert enrichment* ALERT ENRICHMENTLACK OF CONSISTENT VISIBILITY FALSE POSITIVE FATIGUE FRONT LINE OF DEFENSE Threat actors are often leveraging Shadow IT, IoT devices or simply unmanaged devices to maintain persistent access. It requires a fusion between SIEM, network, endpoint etc. to enable triage of activities. Examples: APT10 (CloudHopper), NSA TAO Event if the attack is detected the chance that its identified by the analyst is small due to to many false positives Bonus: Hackers often launch a DDoS attack to flood SIEM systems shortly after a successful targeted attack against a bank.
- 10. COLLECTING OR DETECTING? 10 | © 2019 Palo Alto Networks, Inc. All Rights Reserved. BOTTOM-UP start with data LOG DATA TOP-DOWN start with use case MONTHS vs. DAYS Identify most relevant threats Create use-cases Collect only relevant data Analyze alerts Parse and interpret data Collect available data sources Build use case Data is oil for security operations teams, but collecting simply all available data will not only overload your infrastructure but also impact capacity of your team. Top-down approach considering the entire end-2-end (Identify- detect-respond) use-cases is the way to go for most of the SOCs.
- 11. Alerts must be 90%+ True Positive Move high False Positive Alerts to Hunting Dedicated hunt time Move high True Positive to Alerting 11 | © 2019 Palo Alto Networks. All Rights Reserved. Alerting Program Hunting Program „HUNTING IS A PROCESS, NOT A DEDICATED TEAM“
- 12. 12 | © 2019 Palo Alto Networks, Inc. All Rights Reserved. MACHINE LEARNING WILL INCREASE AUTOMATED RESPONSES PRE-COMPUTE LEARNING OF 1,000+ BEHAVIORAL DIMENSIONS Time Profile • History, per Detector • Network -> Application Peer Profile • Peer profile, per Detector Entity Profile • Entity Type • User, admin, workstation, server, server type MLTechnique Pre-Compute Learning UNSUPERVISEDSUPERVISED
- 13. 13 | © 2019 Palo Alto Networks, Inc. All Rights Reserved. USE CASE
- 14. 14 | © 2019 Palo Alto Networks, Inc. All Rights Reserved. GORCH FOCK SOC DATA LAKE
- 15. 15 | © 2015, Palo Alto Networks. Confidential and Proprietary. DEMISTO - ORCHESTRATION ENGINEER ORCHESTRATEPLATFORMIZE
- 16. Reconnaissance Weaponization and Delivery Exploitation Command and Control Lateral Movement Installation Actions on the Objective Automated Detection and Prevention Threat Alerting and Hunting Focus on this side Focus on this side AFAutoFocus TRTraps WFWildFire GPGlobalProtect AP Aperture 16 | © 2019 Palo Alto Networks. All Rights Reserved. Cortex XDR SHIFT RIGHT – TAKE THE HUMANS OUT OF ROBOTS
- 17. 17 | © 2019 Palo Alto Networks, Inc. All Rights Reserved. USE CASESecurity Operations Update: 1. Your Threat Intelligence team reports other companies experiencing the same Ransomware based cyberattack. 2. The attackers demand Bitcoin in order to decrypt the hard drive. 3. An interesting observation is that the Bitcoin wallet address is always the same.
- 18. THREAT INTELLIGENCE 18 | © 2019 Palo Alto Networks, Inc. All Rights Reserved. ✓ Mature capability for most organizations ✘ More than 95% of consumed intelligence is already known (Waste of money and time) ✘ Companies lack instrumentation of controls to automate consumption ✘ Most companies don’t generate actively threat intelligence CONSUME GENERATE SHARE OPERATIONAL (IOCs, TTPs,) TACTICAL (Adversary campaigns, Trends, Sharing) STRATEGIC (Business risk) ✓ Maturity on government level resulting in cyber policy influence ✘ Most boards lack understanding that they are in software business and cyber is one of the greatest risk ✘ Investment in cybersecurity are by far not proportional to investments in digitalization ✓ Mature capability in some industries e.g. Financial Industry. ✓ Strong community focus e.g. CTA, CSSA, CDA, FS-ISAC ✘ Application of Active Cyber Defense lifecycle takes time
- 19. EXAMPLE: INSTRUMENT YOUR CONTROLS FOR CONSUMPTION Block list Quarantine list Alert list Sandbox ExploitKits, Scanning IPs C2 IPs Move to quarantine network Rebuild device Analyze device Signatures Firewall Endpoint Indicators APT IPs Notify user AI: beaconing SHARING User Violation
- 20. MEASURING AND IMPROVING SOC-CESS 24 | © 2019 Palo Alto Networks, Inc. All Rights Reserved. www.soc-cmm.com
- 21. THREE CATEGORIES OF METRICS HEALTH % of controls running % of assets configured to best practices % of vulnerable systems % of traffic visible … Mean time to detect (MTTD) Time to discover all impacted assets Completeness per IOC sweep Detection for % of all attack vectors Detection for % of all data leakage vectors % of false positive alerts per analytic % of attacks automatically prevented % of users with privilege rights … RESILIENCE Mean time to respond (MTTR) Mean time to rebuild a desktop % of automated countermeasures % of red team exercises detected Time from intrusion to eradication (dwell) … VISIBILITY BUSINESS VALUE AND PRODUCTIVITY METRICS § Losses occurred vs. losses prevented § Mean cost per incident § % of XXX vs industry benchmark …
- 22. EXAMPLE: CONFIGURATION OF ATT&CK VISIBILITY – DETT&CT 27 | © 2019 Palo Alto Networks, Inc. All Rights Reserved. ü Identification of your visibility/log/detection maturity for common attacks described in ATT&CK can help to prioritize configuration ü BUT: To set the right coverage bar for your organization requires mature understanding for relevant threat actor
- 23. EXAMPLE: CONFIGURATION OF DATA LEAKAGE VISIBILITY 28 | © 2019 Palo Alto Networks, Inc. All Rights Reserved. HTTP HTTPS FTP FTPS SMTP ICMP DNS TELNET DNSSEC 62% of known data leakage vectors are identified or prevented Exfiltration of sensitive large data sets sent over longer period of time is not being detected! DATA LEAKAGE SIMULATION Easy and effective deployment allows both: • Prioritize configuration and rules in production • Test security products as part of PoC BUT, how do you define the threshold?
- 24. 29 | © 2015, Palo Alto Networks. Confidential and Proprietary. PLAN FINANCIAL EXISTING METRICS SOAR DOPLAN CHECKACT VERIFICATION DOPLAN CHECKACT DOPLAN CHECKACT THE PATH TO METRICS MATURITY Mean time to X SOC productivity Countermeasure automation Stakeholder responsiveness Network Endpoint Email Security Controls Controls Resilience Exploitation Exfiltration Financial impact Fraud
- 25. EVOLUTION OF THE SOC ROLE – HOW TO KEEP UP? 30 | © 2019 Palo Alto Networks, Inc. All Rights Reserved. *The Definition of SOC-cess? SANS 2018 Security Operations Center Survey TRAINING / ROTATIONS § Technical trainings (e.g. SANS, Data Science) § Rotation between offensive and defensive teams CAREER PATH Especially for technical experts, who are not interested in team management but still want to influence the strategic direction of the company CULTURE OF CURIOSITY will attract smart and passioned talent and help to grow naturally skill and capability LEGAL ENABLEMENT § Access to security data and analysis § Threat Sharing Lack of skilled staff is #1 problem in most organizations* Attrition rates of 20-25% are common in our business. What can be done to retain the staff? FROM ANALYST TO CODER AND DATA SCIENTIST
- 26. enterprise apps today are cloud-enabled /cloud-native Cloud is Everywhere Containers Have Gone Mainstream enterprises will use containers by 2020 8 of 10 1 in 2 of cloud users leverage 2 or more cloud providers (Gartner) 81% Multi-Cloud CLOUD SECOPS IS HEAVILY BEHIND SANS 2019 Cloud Security Survey ● 99% of cloud security failures will be the customers fault by 2023 (Gartner) ● 42% Lack of skills or training for specific public cloud services* ● 52% Inability to respond to incidents traversing our cloud apps and data* CYBERSECURITY LACKS ADOPTION FOR CLOUD TRANSFORMATION
- 27. 32 | © 2018 Palo Alto Networks, Inc. All Rights Reserved. SHIFT LEFT PRINCIPLES </> Code Build Test Deploy Monitor CI Continuous Integration CD Continuous Deployment SHIFT LEFT – WILL INCREASE CODING SKILLS IN SECOPS TEAMS 1. Security by design - establish criteria upfront 2. Integrate, automate, automate 4. Share tooling - don’t silo information 5. Train your developer teams for better awareness 3. Establish control gates SIEM IDS
- 28. COLLABORATION IS EXPLODING 33 | © 2019 Palo Alto Networks, Inc. All Rights Reserved. FUSION CENTER DEPLOY STAFF IN SOC DEPLOY LIASON OFFICERS IN BUSINESS DEPARTMENTS PHYSICAL ✓ Insights into cyber threat actors ✓ Joint work on cyber enabled physical bugs TRANSPORTATION FRAUD BUSINESS ISOs ✓ Joint monitoring of transportation products ✓ Examples: Connected Car, Airplanes, Railways ✓ Improved time to mitigation for cyber enabled fraud ✓ Typically senior security manager roles ✓ Brokers stakeholder relationship and governs remediation in specific business unit DELEGATED TRIAGE ✓ Delegate triage of alerts to users e.g. “Have you been to Switzerland yesterday?”
- 29. 34 | © 2019 Palo Alto Networks, Inc. All Rights Reserved. TRANSFORM YOUR TEAM § Start hiring software engineers and data scientist § Focus on data analysis (Hunting is a process) and communication § Stop Use-Cases below 90% true positive and move to hunting MEASURE SMART § Show business impact § Crawl, walk, run (Same as LEGO) § Focus on “health” usecases first MODERNIZE TECH. STRATEGY § Build technology around automation and not vice versa § Evaluate your toolset: § Take out two for introducing one § Increase penetration rate § Enable features AUTOMATIZE PRODUCTION § Make automation a personal goal for everyone § Prevention First § Increase % of § enriched alerts § of automated countermeasure deployments DEMOCRATIZE COLLABORATION § Implement Delegated Monitoring TAKE AWAYS
- 30. 35 | © 2019 Palo Alto Networks, Inc. All Rights Reserved. Let‘s SOAR