Splunk conf2014 - Operationalizing Advanced Threat Defense
5 likes2,070 views
This document summarizes a presentation about operationalizing advanced threat defense. It discusses how advanced threat actors have established a mature economy of cyber threats with global reach. It then outlines an approach to combat these threats by connecting all security and operational data sources to gain comprehensive visibility, and leveraging threat intelligence and security analytics to detect threats across the entire kill chain. The presentation also demonstrates Enterprise Security 3.x software for continuous monitoring and advanced threat detection.
Splunk conf2014 - Operationalizing Advanced Threat Defense
- 1. Copyright © 2014 Splunk Inc. Monzy Merza Minister of Defense, Splunk, Inc. OperaAonalizing Advanced Threat Defense
- 2. Disclaimer 2 During the course of this presentaAon, we may make forward-‐looking statements regarding future events or the expected performance of the company. We cauAon you that such statements reflect our current expectaAons and esAmates based on factors currently known to us and that actual events or results could differ materially. For important factors that may cause actual results to differ from those contained in our forward-‐looking statements, please review our filings with the SEC. The forward-‐looking statements made in the this presentaAon are being made as of the Ame and date of its live presentaAon. If reviewed aQer its live presentaAon, this presentaAon may not contain current or accurate informaAon. We do not assume any obligaAon to update any forward-‐looking statements we may make. In addiAon, any informaAon about our roadmap outlines our general product direcAon and is subject to change at any Ame without noAce. It is for informaAonal purposes only, and shall not be incorporated into any contract or other commitment. Splunk undertakes no obligaAon either to develop the features or funcAonality described or to include any such feature or funcAonality in a future release.
- 3. Advanced Threat Defense Requires Visibility Context & Intelligence Human Empowerment 3
- 4. Agenda ! The advanced threat actors and their success ! An approach to combat advanced threat actors ! ProducAonizing and operaAonalizing advanced threat defense ! Demo ! Q&A 4
- 5. 5 Mature Economy of Cyber Threats
- 6. 6 Image: eyeswideopen.org Threat Actors Have Global Reach
- 7. Source: Mandiant M-‐Trends Report 2012/2013/2014 7 229 40 100% 67%
- 8. The Adversary’s M.O. : Kill Chain 8 • The adversary works to understand your organizaAon looking for opportuniAes Reconnaissance • Your system is compromised and the adversary goes to work ExploitaAon • The afacker steals data, disrupts your operaAons or causes damage… AcAng on Intent
- 9. OperaAonalizing Advanced Threat Defense 9
- 10. Intrusion DetecAon Firewall Data Loss PrevenAon AnA-‐ Malware Vulnerability Scans Tradi.onal Security Strategy AuthenAcaAon 10
- 11. Connect the Dots Across All Data Servers Storage Desktops Email Web TransacAon Records Network Flows Hypervisor Custom Apps Physical Access Badges Threat Intelligence Mobile CMBD DHCP/ DNS Intrusion DetecAon Firewall Data Loss PrevenAon AnA-‐ Malware Vulnerability Scans AuthenAcaAon 11
- 12. 12 Threat Intelligence Network Endpoint AuthenAcaAon Minimum Set of Sources
- 13. 13 Online Services Web Services Security GPS LocaAon Storage Desktops Networks Packaged ApplicaAons Custom ApplicaAons Messaging Telecoms Online Shopping Cart Web Clickstreams Databases Energy Meters Call Detail Records Smartphones and Devices Security Intelligence Firewall AuthenAcaAon Threat Intelligence Servers Endpoint
- 14. Security Intelligence 14 Raw Events Online Services Web Services Security GPS LocaAon Storage Desktops Networks Packaged ApplicaAons Custom ApplicaAons Messaging Telecoms Online Shopping Cart Web Clickstreams Databases Energy Meters Call Detail Records Smartphones and Devices Firewall AuthenAcaAon Threat Intelligence Servers Endpoint
- 15. Security Intelligence 15 Threat Intelligence Asset & CMDB Employee Info Data Stores Applica.ons Raw Events Online Services Web Services Security GPS LocaAon Storage Desktops Networks Packaged ApplicaAons Custom ApplicaAons Messaging Telecoms Online Shopping Cart Web Clickstreams Databases Energy Meters Call Detail Records Smartphones and Devices Firewall AuthenAcaAon Threat Intelligence Servers Endpoint
- 16. Security Intelligence 16 Report and analyze Custom dashboards Monitor and alert Ad hoc search Threat Intelligence Asset & CMDB Employee Info Data Stores Applica.ons Raw Events Online Services Web Services Security GPS LocaAon Storage Desktops Networks Packaged ApplicaAons Custom ApplicaAons Messaging Telecoms Online Shopping Cart Web Clickstreams Databases Energy Meters Call Detail Records Smartphones and Devices Firewall AuthenAcaAon Threat Intelligence Servers Endpoint
- 17. 17 Enterprise Security 3.x ConAnuous Monitoring and Advanced Threat DetecAon
- 18. 18
- 19. 19
- 20. 20
- 21. 21
- 22. 22
- 23. What’s New in ES 3.1 RISK-‐BASED ANALYTICS VISUALIZE AND DISCOVER RELATIONSHIPS ENRICH SECURITY ANALYSIS WITH THREAT INTELLIGENCE Risk Scoring Framework KSI/KPI/KRI Edi.ng Contribu.ng Factors Analysis GUI Edi.ng of Swimlanes Guided Search Builder Domain and URL threat Intel Aggrega.on and Deduplica.on Threat Intel Source Weights 23
- 24. 24 Demo
- 25. 25 Threat Intelligence Network Endpoint AuthenAcaAon Advanced Threat Defense Starts Here
- 26. Security Intelligence 26 Developer PlaUorm Report and analyze Custom dashboards Monitor and alert Ad hoc search Threat Intelligence Asset & CMDB Employee Info Data Stores Applica.ons Online Services Web Services Security GPS LocaAon Storage Desktops Networks Packaged ApplicaAons Custom ApplicaAons Messaging Telecoms Online Shopping Cart Web Clickstreams Databases Energy Meters Call Detail Records Smartphones and Devices Firewall AuthenAcaAon Threat Intelligence Servers Endpoint
- 27. Thousands of Global Security Customers 27
- 28. Industry RecogniAon 28 2012 2013 Product/Service Rating AccelOps AlienVault BlackStratus EventTracker HP(ArcSight) IBMSecurity(QRadar) LogRhythm McAfee(ESM) Real-Time Monitoring 3.50 3.00 3.00 2.9 4.1 4.0 3.75 3.75 Threat Intelligence 3.00 3.50 2.50 1.5 4.0 4.0 3.25 4.00 Behavior Profiling 2.50 3.50 2.50 2.8 4.0 4.5 3.38 3.50 Data and User Monitoring 2.97 2.43 2.16 3.2 4.2 3.8 3.41 4.44 Application Monitoring 2.90 3.65 2.90 3.2 4.5 4.3 4.10 4.20 Analytics 2.44 3.19 2.94 2.9 3.8 3.7 3.30 3.59 Log Management and Reporting 2.75 3.00 2.50 3.4 4.0 3.8 3.75 3.25 Deployment/Support Simplicity 3.50 4.00 3.00 4.3 3.7 4.3 4.25 4.00 Source: Gartner (June 2014)
- 29. 29 Enterprise Security Office Hours @Room 103 Best Kept Secrets of Enterprise Security Dimitri McKay Automated MiAgaAon With Enterprise Security Jose Hernandez Enterprise Security @Apps Showcase CPE, CISSP Credits For Security Talks
- 30. 30 Security office hours: 11:00 AM – 2:00 PM @Room 103 Everyday Geek out, share ideas with Enterprise Security developers Red Team / Blue Team -‐ Challenge your skills and learn new tricks Mon-‐Wed: 3:00 PM – 6:00 PM @Splunk Community Lounge Thurs: 11:00 AM – 2:00 PM Learn, share and hack Birds of a feather-‐ Collaborate and brainstorm with security ninjas Thurs: 12:00 PM – 1:00 PM @Meal Room