Logs in Security and Compliance flare
- 1. Log Data Compliance and Security drivers
- 2. • I think organisations want to achieve better Visibility Analytics and Cyber Security posture in order to “remain in the game”
- 3. Compliance
- 5. • Risk management and assesment • Audit trail • Forensic • Leak protection • User right management • Separation of duties
- 6. Security
- 7. • Incident responce/Management • Identify/Analyse/Gather Evidence • Users/Systems Auditing • Forensic • Leak Prevention/protection • Blue/Red • Business enablement • APT
- 8. • Security and Compliance activities in an organisation relay on visibility into the organisations systems and data, this activities have strong dependencies on Logged data among other mechanisms used.
- 9. Example • DBA • Hard working Individual • HR cleared • Strong technically • Wider access to system than “normal users”
- 11. • Targeted • Advance Phishing Techniques • Social Eng./Networks • Reconnaissance • InfoSec “Black market”
- 13. Organisation Facing difficult questions as: • Who AUDIT your DATA? • Are you ready for answering (WhatWhereWhen)? • Do you have a response capability? • Are your people trained ? • What happens WHEN you get compromised?
- 15. Log = Intelligence Log = Evidence Log = Accountability
- 16. http://datalossdb.org/statistics Discover Indicators Of Compromise for your information Crown Jewels.
- 17. • Collecting Log information from Systems Applications and Infrastructure provide us with the power of knowledge and the ability to evidence and answer as required.
- 18. What's “out there”… ◇ We use native auditing, it meets our needs… ◇ Can’t risk performance degradation or latency… ◇ The database/DATA is locked down, we trust the people who can access it… ◇ Our database/DATA is encrypted… ◇ Its too complex, I would need to dedicate a headcount to manage it. ◇ It’s too expensive… ◇ Too early, only starting to look at such solutions… ◇ We don’t store sensitive data in our network…
- 19. • Organisations that are breached tend to be less compliant. • Most attacks against databases involve: • Compromising user accounts or • Running queries within the privileges of the user • Database/Data encryption can’t protect against these attacks • Audit will provide the needed details to investigate a data breach event (internal or external) • If regulated (PCI, SOX…) then an audit trail is REQUIRED.