Cyber Security Summit 2015
|
|
|
- Clement Jackson
- 8 years ago
- Views:
Transcription
1 Cyber Security Summit 2015 Threat Intelligence 101: Introduction and Foundations Matthew J. Harmon IT Risk Limited, LLC
2 Matthew J. Harmon IT Risk Limited, Principal Consultant DFIR, Pen Testing, Risk Management, IT Audit SANS Instructor (401, 464, 504) Security Essentials, Hacker Tools, Techniques, Exploits & Incident Handling), and Hacker Guard, IT Operations Baselining GSEC, GCIH, GCIA, CISSP NorSec ISAO, Working Board Member Information Sharing Analysis Organization
3 What are we going to cover today? State of Cyber Security Short overview of where we are today Discuss What is Threat Intelligence? Explain CybOX, STIX & TAXII Real world example structuring CybOX & STIX Show two examples of Threat Intelligence Threat Connect and Critical Stack Show you how to Do It Yourself Homework Lab with Bro and Critical Stack
4 State of Cyber Security It could be worse... BUT Source: PBS Sesame Street, Oscar the Grouch
5 Breaches are inevitable - against a motivated attacker...with time and resources Source: BBC Sherlock Holmes - The Reichenbach Fall Moriarty stealing the crown jewels
6 but it doesn t take a super genius
7 but it doesn t take a super genius
8 Incidents and Data Loss: 2014 Source: Verizon 2015 Data Breach Investigations Report
9 Attack Vectors: 2014 Source: Verizon 2015 Data Breach Investigations Report
10 Time to Discover: 2014 Source: Verizon 2015 Data Breach Investigations Report
11 Latest Breaches - Summary 100 Banks, 30 Countries $1B fraudulent transfers (2yrs) Michaels 2.6 Mil cards Af nity Gaming 11 Casinos New York Attorney General 22.8 Mil records Community Health Systems 4.5 Mil patient records Adult FriendFinder 3.9 Mil Ashley Madison 37 Mil personal records Of ce of Personnel Management 21.5 Mil SF-86++ Experian - 15 Million T-Mobile Customers (One le!) JP Morgan Chase 76 mil houses + 7 mil businesses... and many, many more.
12 We really need to get better at this Photo: McKayla Maroney, 2012 London Olympics McKayla Not Impressed
13 Change is good, Sharing is good Network Source: Calvin and Hobbes by Bill Watterson (1995)
14 We need to learn from each other Executive Order Promoting Private Sector Cybersecurity Information Sharing On Feb 13, 2015 formed Information Sharing Analysis Organization s or ISAO s Similar to ISAC s and Cyber Fusion Centers not necessarily siloed by sector or industry Anyone can participate! No more re-discovering the same attacks
15 What is Threat Intelligence? Indicators of Compromise (IoC s) Relevant Threat Activity DNS Hosts IP Addresses Addresses URLs Files (hashes) + = Campaigns Malware Known Adversaries Crowd Sourced Actionable Cyber Threat Intelligence Vetted by experts
16 How to share our information? Many indicators, unvetted IoCs are low confidence (1) Live attacks and campaigns are high (5), Everything else is somewhere in between How do we share information? Here s two: CybOX, STIX & TAXII Cyber Observables Structured Threat Information Trusted Automated exchange of Indicator Information Tab Separated Values (Critical Stack + Bro)
17 CybOX, STIX & TAXII CybOX is the dictionary of words Cyber Observables Phishing, Exploit Target, Campaign, Cyber Adversary STIX is a language that uses CybOX terms XML + Schema Definition Object Types with Context (C2 IP, , Domain, Account) TAXII defines how STIX is shared Client-Server over HTTP Inbox (Push), Poll (Pull)
18 STIX Representations Observable: An event or stateful property Indicator: Observable with context Incident: Set of activities Tactics Techniques and Procedures (TTP): Ops Exploit Target: Weakness exploited by TTP Course of Action (COA): Defense; prevention, remediation, mitigation Campaign: Set of related TTPs, indicators, incidents and exploit targets Threat Actor: The adversary
19 CybOX Objects - Subset AccountObj: Domain, Authentication, Date/Time AddressObj: ipv4/ipv6 address, VLAN, ArchiveFileObj: 7-zip, ZIP, APK, CAB, SIT, TGZ DomainNameObj: Fully qualified domain name MessageObj: Received, To, CC, From, Subject URIObj: A Uniform Resource Locator (URL) WhoisObj: Contact, Domain Name, Nameserver X509CertificateObj: Serial number, Alg, Subject
20 Real world CybOX, STIX & TAXII Excessive traffic is noticed on a server from a single workstation - investigation begins Tracing the workstation back to a user, an from jane.smith@adp.com with a.zip attachment (Indicator) The had a Return-Path: of <AmericanExpress@welcome.aexp.com> Received from: bba alshamil.net.ae IP (Indicator)
21 Real world CybOX, STIX & TAXII.zip attachment is named Invoice_ zip (indicator) md5 5d6cbd0a557bb10603bb63b8fe0c4160.zip contains an executable Invoice_ exe md5 911b7604e84096ee5bbb6741cf02542c (observable) Executable reaches out over HTTP to (indicator) redirects downloads to porfintengoweb.com/css/11s1.zip jc-charge-it.nl/pages/11s1.zip flightss.d-webs.com/images/airlines-logo/h76id30.zip
22 Real world CybOX, STIX & TAXII Through researching this executable you find it is a part of the dyreza malware, a banking trojan This trojan uses a Domain Generation Algorithm (TTP) and reaches out to hosts in the pacific islands (TTP) and uses I2P (TTP) You deploy blocks (COA) to the s with the MD5 signature and block HTTP to the C2 hosts Sharing this information with your peers (TAXII) you find other similar victims who link their incident to your observations discovering a campaign.
23 Pieces of STIX - Headers Headers for a CybOX compliant STIX package <stix:stix_package <stix:stix_header> <stix:title>dryeza Phishing Indicator</stix:Title> <stix:package_intent xsi:type="stixvocabs:packageintentvocab-1.0">indicators - Phishing</stix:Package_Intent> </stix:stix_header>
24 Pieces of STIX - ZIP file Hash Identify File Extension, Size and Hash <cybox:related_object> <cybox:properties xsi:type="fileobj:fileobjecttype"> <FileObj:File_Extension>zip</FileObj:File_Extension> <FileObj:Size_In_Bytes>9531</FileObj:Size_In_Bytes> <FileObj:Hashes><cyboxCommon:Hash> <cyboxcommon:simple_hash_value>5d6cbd0a557bb10603bb63b8fe0c4160</c yboxcommon:simple_hash_value> <indicator:indicated_ttp> <stixcommon:ttp xsi:type="ttp:ttptype"> <TTP:Description>Phishing<TTP:Description></TTP:Attack_Pattern>
25 Pieces of STIX - IP Watchlist Short Course of Action with C2 watchlist IPs <stix:stix_header> <stix:title>dryeza C2 watchlist IPs.</stix:Title> <stix:package_intent xsi:type="stixvocabs:packageintentvocab-1.0">indicators - Watchlist</stix:Package_Intent> <cybox:properties xsi:type="addressobject:addressobjecttype" category="ipv4- addr"> <AddressObject:Address_Value condition="equals" apply_condition="any"> ##comma## </addressobject:add ress_value> </cybox:properties>
26 Pieces of STIX - URL Watchlist Short Course of Action header with URL watchlist URI s <cybox:object> <cybox:properties xsi:type="uriobject:uriobjecttype"> <URIObject:Value condition="equals" apply_condition="any"> </URIObject:Value> </cybox:properties>
27 Example IOC via CybOX + STIX
28 Example TAXII Poll (Pull) Request
29 Example TAXII Poll (Pull) Response
30 Let s look at two different exchanges ThreatConnect is a collaborative Threat Intelligence Platform Threat data collection, analysis, collaboration Incident response experts on staff to vet info Free for NorSec and other ISAO Members CriticalStack // Intel is an aggregation of open source indicators of compromise 100+ Feeds, easy to read Tab Separated Values, client integration with Bro!
31 Let s look at some live data. ThreatConnect Common Community Demo
32 Known Adversaries (ThreatConnect)
33 Indicators of Compromise (ThreatConnect)
34 Feeds (CriticalStack // Intel)
35 How do you use the feeds? Bro! Bro is an open source network analysis framework with well structured, easy to parse data with bro-cut Unbeatable resource for forensics activities, network baselining and network visibility Built into the Security Onion Linux distro Available at
36 Feeds (.bro.dat)
37 Feed Content (CryptoWall Malware) CryptoWall Ransomware Domains # cd /opt/critical-stack/frameworks/intel/.cache; cat critical-stack-intel-37- Cryptowall--Domain-List.bro.dat #fields indicator indicator_type meta.source adolfforua.com Intel::DOMAIN babamamama.com Intel::DOMAIN craspatsp.com Intel::DOMAIN crynigermike.com Intel::DOMAIN
38 Feed Content (PoSeidon Malware) Point of Sale system malware PoSeidon Domains # cd /opt/critical-stack/frameworks/intel/.cache; cat critical-stack-intel-106- team-cymru.org-poseidon-iocs.bro.dat #fields indicator indicator_type meta.source askyourspace.com/ldl01aef/viewtopic.php Intel::URL Intel::ADDR Intel::ADDR 164af045a08d718372dd6ecd34b746e b1 Intel::FILE_HASH Intel::FILE_HASH
39 critical-stack-intel list
40 bro-cut -d -C < intel.log -d = time values human readable -C = include all headers
41 Prototyping with Raspberry Pi 2
42 Want to participate in NorSec? We need Alpha Testers and First Members us:
43 Contact Matt Weikert at Chris Crayne at
44 Lab Install Security Onion Comes with bro preconfigured! or Install Bro Sign up at Critical Stack // Intel: Follow the setup instructions: Setup your first client to add Bro rules to Security Onion Setup a span, mirror or network Get employer permission for a Threat Intel Throwing Star LAN Tap, NetGear GS108E ($60)
45 Thank you! Lab, Resources & Links
Separating Signal from Noise: Taking Threat Intelligence to the Next Level
SESSION ID: SPO2-T09 Separating Signal from Noise: Taking Threat Intelligence to the Next Level Doron Shiloach X-Force Product Manager IBM @doronshiloach Agenda Threat Intelligence Overview Current Challenges
FROM INBOX TO ACTION EMAIL AND THREAT INTELLIGENCE:
WHITE PAPER EMAIL AND THREAT INTELLIGENCE: FROM INBOX TO ACTION There is danger in your email box. You know it, and so does everyone else. The term phishing is now part of our daily lexicon, and even if
81% of participants believe the government should share more threat intelligence with the private sector.
Threat Intelligence Sharing & the Government s Role in It Results of a Survey at InfoSec 2015 Section 1 1.1 Executive summary The last few years has seen a rise in awareness regarding security breaches
After the Attack: RSA's Security Operations Transformed
After the Attack: RSA's Security Operations Transformed Ben Smith, CISSP RSA Field CTO (East), Security Portfolio Senior Member, ISSA Northern Virginia 1 The Environment ~ 2,000 security devices ~55M security
Eight Essential Elements for Effective Threat Intelligence Management May 2015
INTRODUCTION The most disruptive change to the IT security industry was ignited February 18, 2013 when a breach response company published the first research that pinned responsibility for Advanced Persistent
Soltra edge open cyber intelligence platform report
Soltra edge open cyber intelligence platform report Prepared By: Alan Magar Sphyrna Security 340 Ridgeside Farm Drive Kanata, Ontario K2W 0A1 PWGSC Contract Number: W7714-08FE01/001/ST Task 33 CSA: Melanie
Operational Lessons from the RSA/EMC CIRC: People, Process, & Threat Intel
Operational Lessons from the RSA/EMC CIRC: People, Process, & Threat Intel @Ben_Smith Ben Smith, CISSP Field CTO (US East), Security Portfolio A Security Maturity Path CONTROLS COMPLIANCE IT RISK BUSINESS
All about Threat Central
All about Threat Central Ted Ross & Nadav Cohen #HPProtect Forward-looking statements This is a rolling (up to three year) Roadmap and is subject to change without notice. This document contains forward
The New ROI: Results Oriented Intel. David Amsler, Founder
The New ROI: Results Oriented Intel David Amsler, Founder Foreground Security Dedicated Security services firm Founded in 2000 with offices in Florida, Virginia, and Maryland Federal and commercial clients
Redefining SIEM to Real Time Security Intelligence
Redefining SIEM to Real Time Security Intelligence David Osborne Security Architect September 18, 2012 Its not paranoia if they really are out to get you Malware Malicious Insiders Exploited Vulnerabilities
Things To Do After You ve Been Hacked
Problem: You ve been hacked! Now what? Solution: Proactive, automated incident response from inside the network Things To Do After You ve Been Hacked Tube web share It only takes one click to compromise
SOLUTION PRIMER. Rafal Los Director, Solutions Research Office of the CISO, Accuvant. James Robinson Director, Information Security, Accuvant
THREAT INTELLIGENCE Rafal Los Director, Solutions Research Office of the CISO, Accuvant James Robinson Director, Information Security, Accuvant Jason Clark Chief Strategy and Security Officer, Accuvant
Analytic and Predictive Modeling of Cyber Threat Entities J. Wesley Regian, Ph.D.
18th Annual Space & Missile Defense Symposium IAMD Evolution and Integration/Key Topic: Predictive Cyber Threat Analysis Analytic and Predictive Modeling of Cyber Threat Entities J. Wesley Regian, Ph.D.
Machine-to-Machine Exchange of Cyber Threat Information: a Key to Mature Cyber Defense
Machine-to-Machine Exchange of Cyber Threat Information: a Key to Mature Cyber Defense By: Daniel Harkness, Chris Strasburg, and Scott Pinkerton The Challenge The Internet is an integral part of daily
Security A to Z the most important terms
Security A to Z the most important terms Part 1: A to D UNDERSTAND THE OFFICIAL TERMINOLOGY. This is F-Secure Labs. Learn more about the most important security terms with our official explanations from
The Third Rail: New Stakeholders Tackle Security Threats and Solutions
SESSION ID: CXO-R03 The Third Rail: New Stakeholders Tackle Security Threats and Solutions Ted Ross Director, Threat Intelligence HP Security Research @tedross Agenda My brief background An example of
Security Intelligence Services. www.kaspersky.com
Kaspersky Security Intelligence Services. Threat Intelligence Services www.kaspersky.com THREAT INTELLIGENCE SERVICES Tracking, analyzing, interpreting and mitigating constantly evolving IT security threats
Symantec Cyber Threat Analysis Program Program Overview. Symantec Cyber Threat Analysis Program Team
Symantec Cyber Threat Analysis Program Symantec Cyber Threat Analysis Program Team White Paper: Symantec Security Intelligence Services Symantec Cyber Threat Analysis Program Contents Overview...............................................................................................
All Information is derived from Mandiant consulting in a non-classified environment.
Disclaimer: All Information is derived from Mandiant consulting in a non-classified environment. Case Studies are representative of industry trends and have been derived from multiple client engagements.
Into the cybersecurity breach
Into the cybersecurity breach Tim Sanouvong State Sector Cyber Risk Services Deloitte & Touche LLP April 3, 2015 Agenda Setting the stage Cyber risks in state governments Cyber attack vectors Preparing
Targeted Intrusion Remediation: Lessons From The Front Lines. Jim Aldridge
Targeted Intrusion Remediation: Lessons From The Front Lines Jim Aldridge All information is derived from MANDIANT observations in non-classified environments. Information has beensanitized where necessary
You ll learn about our roadmap across the Symantec email and gateway security offerings.
#SymVisionEmea In this session you will hear how Symantec continues to focus our comprehensive security expertise, global intelligence and portfolio on giving organizations proactive, targeted attack protection
Addressing APTs and Modern Malware with Security Intelligence Date: September 2013 Author: Jon Oltsik, Senior Principal Analyst
ESG Brief Addressing APTs and Modern Malware with Security Intelligence Date: September 2013 Author: Jon Oltsik, Senior Principal Analyst Abstract: APTs first came on the scene in 2010, creating a wave
Advanced Visibility. Moving Beyond a Log Centric View. Matthew Gardiner, RSA & Richard Nichols, RSA
Advanced Visibility Moving Beyond a Log Centric View Matthew Gardiner, RSA & Richard Nichols, RSA 1 Security is getting measurability worse Percent of breaches where time to compromise (red)/time to Discovery
Unified Security Management and Open Threat Exchange
13/09/2014 Unified Security Management and Open Threat Exchange RICHARD KIRK SENIOR VICE PRESIDENT 11 SEPTEMBER 2014 Agenda! A quick intro to AlienVault Unified Security Management (USM)! Overview of the
QUARTERLY REPORT 2015 INFOBLOX DNS THREAT INDEX POWERED BY
QUARTERLY REPORT 2015 INFOBLOX DNS THREAT INDEX POWERED BY EXPLOIT KITS UP 75 PERCENT The Infoblox DNS Threat Index, powered by IID, stood at 122 in the third quarter of 2015, with exploit kits up 75 percent
Trend Micro Incorporated Research Paper 2012. Adding Android and Mac OS X Malware to the APT Toolbox
Trend Micro Incorporated Research Paper 2012 Adding Android and Mac OS X Malware to the APT Toolbox Contents Abstract... 1 Introduction... 1 Technical Analysis... 2 Remote Access Trojan Functionality...
Concierge SIEM Reporting Overview
Concierge SIEM Reporting Overview Table of Contents Introduction... 2 Inventory View... 3 Internal Traffic View (IP Flow Data)... 4 External Traffic View (HTTP, SSL and DNS)... 5 Risk View (IPS Alerts
SHARING THREAT INTELLIGENCE ANALYTICS FOR COLLABORATIVE ATTACK ANALYSIS
SHARING THREAT INTELLIGENCE ANALYTICS FOR COLLABORATIVE ATTACK ANALYSIS Samir Saklikar RSA, The Security Division of EMC Session ID: CLE T05 Session Classification: Intermediate Agenda Advanced Targeted
Threat Intelligence: An Essential Component of Cyber Incident Response. Jeanie M Larson, CISSP-ISSMP, CISM, CRISC
Threat Intelligence: An Essential Component of Cyber Incident Response Jeanie M Larson, CISSP-ISSMP, CISM, CRISC What are we going to cover? Setting the Stage Why is Incident Response Critical? Cyber Threat
Information Security for the Rest of Us
Secure Your Way Forward. AuditWest.com Information Security for the Rest of Us Practical Advice for Small Businesses Brian Morkert President and Chief Consultant 1 Introduction President Audit West IT
Network Security Monitoring
Network Security Monitoring Network Startup Resource Center www.nsrc.org These materials are licensed under the Creative Commons Attribution-NonCommercial 4.0 International license (http://creativecommons.org/licenses/by-nc/4.0/)
How To Manage Threat Intelligence On A Microsoft Microsoft Iphone Or Ipad Or Ipa Device
Product Brochure ThreatStream Optic ThreatStream Threat Intelligence Platform Imagine being able to make sense of all the threat information that s flowing through your security controls and coming from
Who Drives Cybersecurity in Your Business? Milan Patel, K2 Intelligence. AIBA Quarterly Meeting September 10, 2015
Who Drives Cybersecurity in Your Business? Milan Patel, K2 Intelligence AIBA Quarterly Meeting September 10, 2015 The Answer 2 Everyone The relationship between the board, C-suite, IT, and compliance leaders
Integrating MSS, SEP and NGFW to catch targeted APTs
#SymVisionEmea #SymVisionEmea Integrating MSS, SEP and NGFW to catch targeted APTs Tom Davison Information Security Practice Manager, UK&I Antonio Forzieri EMEA Solution Lead, Cyber Security 2 Information
Protecting companies. against cyber-attacks. -Interview with Christopher Crowley by Mitsuyoshi Sugaya- 10.September.2015. lakyara vol.
lakyara Special Edition Protecting companies against cyber-attacks 10.September.2015 Executive Summary Information theft and other losses due to cyber-attacks is a growing problem even in Japan. Fortification
Sophisticated Indicators for the Modern Threat Landscape: An Introduction to OpenIOC
WHITE PAPER Sophisticated Indicators for the Modern Threat Landscape: An Introduction to OpenIOC www.openioc.org OpenIOC 1 Table of Contents Introduction... 3 IOCs & OpenIOC... 4 IOC Functionality... 5
Cyber Threat Intelligence Move to an intelligencedriven cybersecurity model
Cyber Threat Intelligence Move to an intelligencedriven cybersecurity model Stéphane Hurtaud Partner Governance Risk & Compliance Deloitte Laurent De La Vaissière Director Governance Risk & Compliance
Building The Human Firewall. Andy Sawyer, CISM, C CISO Director of Security Locke Lord
Building The Human Firewall Andy Sawyer, CISM, C CISO Director of Security Locke Lord Confidentiality, Integrity, Availability Benchmarks of Cybersecurity: Confidentiality Information is protected against
The Next Generation Security Operations Center
The Next Generation Security Operations Center Vassil Barsakov Regional Manager, CEE & CIS RSA, the Security Division of EMC 1 Threats are Evolving Rapidly Criminals Petty criminals Unsophisticated Organized
Attackers are reusing attacks (because they work)
The Problem Attackers are reusing attacks (because they work) Defenders are collecting and/or sharing information, but Often a manual process (copy-paste from a PDF) Different sources provide different
cyber Threat Intelligence - A Model for the 21st Century
HOW DO YOU CREATE A WORLD FINANCIAL COMMUNITY THAT IS RESILIENT IN THE FACE OF CYBER-SECURITY, CYBER-ESPIONAGE, AND HACKING? Biographies of Authors William Abbott Foster, PhD is a Senior Research Associate
Cloud and Critical Infrastructures how Cloud services are factored in from a risk perspective
Cloud and Critical Infrastructures how Cloud services are factored in from a risk perspective Reaching the Cloud era in the EU Riga 16 June 2015 Jonathan Sage Government and Regulatory Affairs Cyber Security
Comprehensive Advanced Threat Defense
1 Comprehensive Advanced Threat Defense June 2014 PAGE 1 PAGE 1 1 INTRODUCTION The hot topic in the information security industry these days is Advanced Threat Defense (ATD). There are many definitions,
Digital Evidence and Threat Intelligence
Digital Evidence and Threat Intelligence 09 November 2015 Mark Clancy CEO www.soltra.com @soltraedge External Threats Growing 117,339 incoming attacks every day The total number of security incidents detected
Using SIEM for Real- Time Threat Detection
Using SIEM for Real- Time Threat Detection Presentation to ISSA Baltimore See and secure what matters Joe Magee CTO and Co-Founder March, 27 2013 About us Vigilant helps clients build and operate dynamic,
Obtaining Enterprise Cybersituational
SESSION ID: SPO-R06A Obtaining Enterprise Cybersituational Awareness Eric J. Eifert Sr. Vice President Managed Security Services DarkMatter Agenda My Background Key components of the Cyber Situational
FS-ISAC CHARLES BRETZ
FS-ISAC CHARLES BRETZ Information Sharing To be forewarned is to be fore-armed MISSION: Sharing Timely, Relevant, Actionable Cyber and Physical Security Information & Analysis A nonprofit private sector
Open Source Threat Intelligence. Kyle R Maxwell (@kylemaxwell) Senior Researcher, Verizon RISK Team
Open Source Threat Intelligence Kyle R Maxwell (@kylemaxwell) Senior Researcher, Verizon RISK Team 2 Before we begin All trademarks belong to their respective owners. No association with any other organizations,
September 20, 2013 Senior IT Examiner Gene Lilienthal
Cyber Crime September 20, 2013 Senior IT Examiner Gene Lilienthal The following presentation are views and opinions of the speaker and does not necessarily reflect the views of the Federal Reserve Bank
A Primer on Cyber Threat Intelligence
A Primer on Cyber Threat Intelligence AS ADVERTISED 2 BUZZWORD BINGO! 3 TODAY S CYBER SECURITY CHALLENGES CISOs finding it difficult to define security ROI to executives Short shelf life for CISOs Vastly
Can We Become Resilient to Cyber Attacks?
Can We Become Resilient to Cyber Attacks? Nick Coleman, Global Head Cyber Security Intelligence Services December 2014 Can we become resilient National Security, Economic Espionage Nation-state actors,
How To Test For Security On A Network Without Being Hacked
A Simple Guide to Successful Penetration Testing Table of Contents Penetration Testing, Simplified. Scanning is Not Testing. Test Well. Test Often. Pen Test to Avoid a Mess. Six-phase Methodology. A Few
HACKER INTELLIGENCE INITIATIVE. The Secret Behind CryptoWall s Success
HACKER INTELLIGENCE INITIATIVE The Secret Behind 1 1. Introduction The Imperva Application Defense Center (ADC) is a premier research organization for security analysis, vulnerability discovery, and compliance
Evaluating DMARC Effectiveness for the Financial Services Industry
Evaluating DMARC Effectiveness for the Financial Services Industry by Robert Holmes General Manager, Email Fraud Protection Return Path Executive Summary Email spoofing steadily increases annually. DMARC
Niara Security Analytics. Overview. Automatically detect attacks on the inside using machine learning
Niara Security Analytics Automatically detect attacks on the inside using machine learning Automatically detect attacks on the inside Supercharge analysts capabilities Enhance existing security investments
Cyber Threats Insights from history and current operations. Prepared by Cognitio May 5, 2015
Cyber Threats Insights from history and current operations Prepared by Cognitio May 5, 2015 About Cognitio Cognitio is a strategic consulting and engineering firm led by a team of former senior technology
Who s Doing the Hacking?
Who s Doing the Hacking? 1 HACKTIVISTS Although the term hacktivist refers to cyber attacks conducted in the name of political activism, this segment of the cyber threat spectrum covers everything from
Security Intelligence
IBM Security Security Intelligence Security for a New Era of Computing Erno Doorenspleet Consulting Security Executive 1 PARADIGM SHIFT in crime Sophistication is INCREASING Attacks are More Targeted Attackers
Unstructured Threat Intelligence Processing using NLP
Accenture Technology Labs Elvis Hovor @kofibaron Shimon Modi @shimonmodi Shaan Mulchandani @alabama_shaan Unstructured Threat Intelligence Processing using NLP Enhancing Cyber Security Operations by Automating
DEFENSE THROUGHOUT THE VULNERABILITY LIFE CYCLE WITH ALERT LOGIC THREAT AND LOG MANAGER
DEFENSE THROUGHOUT THE VULNERABILITY LIFE CYCLE WITH ALERT LOGIC THREAT AND Introduction > New security threats are emerging all the time, from new forms of malware and web application exploits that target
Doris Yang dyang@vectranetworks.com Vectra Networks, Inc. June 16, 2015 The World Ahead
Doris Yang dyang@vectranetworks.com Vectra Networks, Inc. 1 June 16, 2015 The World Ahead June 16, 2015 The World Ahead Disclaimer The views and opinions expressed during this conference are those of the
Security Analytics for Smart Grid
Security Analytics for Smart Grid Dr. Robert W. Griffin Chief Security Architect RSA, the Security Division of EMC robert.griffin@rsa.com blogs.rsa.com/author/griffin @RobtWesGriffin 1 No Shortage of Hard
Modern Approach to Incident Response: Automated Response Architecture
SESSION ID: ANF-T10 Modern Approach to Incident Response: Automated Response Architecture James Carder Director, Security Informatics Mayo Clinic @carderjames Jessica Hebenstreit Senior Manager, Security
The Top Web Application Attacks: Are you vulnerable?
QM07 The Top Web Application Attacks: Are you vulnerable? John Burroughs, CISSP Sr Security Architect, Watchfire Solutions jburroughs@uk.ibm.com Agenda Current State of Web Application Security Understanding
Protecting against cyber threats and security breaches
Protecting against cyber threats and security breaches IBM APT Survival Kit Alberto Benavente Martínez abenaventem@es.ibm.com IBM Security Services Jun 11, 2015 (Madrid, Spain) 12015 IBM Corporation So
Defending Against Data Beaches: Internal Controls for Cybersecurity
Defending Against Data Beaches: Internal Controls for Cybersecurity Presented by: Michael Walter, Managing Director and Chris Manning, Associate Director Protiviti Atlanta Office Agenda Defining Cybersecurity
Critical Security Controls
Critical Security Controls Session 2: The Critical Controls v1.0 Chris Beal Chief Security Architect MCNC chris.beal@mcnc.org @mcncsecurity on Twitter The Critical Security Controls The Critical Security
A New Security Dimension: Industry Experience Using Open Standards to Accelerate Threat Response
A New Security Dimension: Industry Experience Using Open Standards to Accelerate Threat Response Jason Corbin VP Product Management and Strategy IBM Security Cyber Threat Intelligence Refresher Payload
You Don t Know What You Can t See: Network Security Monitoring in ICS Rob Caldwell
You Don t Know What You Can t See: Network Security Monitoring in ICS Rob Caldwell Mandiant, a FireEye company [2014 SANS European ICS Summit] About me Currently: Principal Consultant on Mandiant s Industrial
Threat Intelligence Buyer s Guide
Threat Intelligence Buyer s Guide SANS CTI Summit, 10 February 2014 Rick Holland @rickhholland Principal Analyst Last year 2014 Forrester Research, Inc. Reproduction Prohibited 2 This year, Arnold s back!!
Threat Intelligence: STIX and Stones Will Break Your Foes
Copyright 2014 Splunk Inc. Threat Intelligence: STIX and Stones Will Break Your Foes Fred Wilmot Director, Global Security PracCce Brad Lindow a.k.a. Superman Global Security Strategist, Splunk Disclaimer
Cybersecurity Governance Update on New FFIEC Requirements
Cybersecurity Governance Update on New FFIEC Requirements cliftonlarsonallen.com Our perspective CliftonLarsonAllen Started in 1953 with a goal of total client service Today, Professional Services Firm
THREAT VISIBILITY & VULNERABILITY ASSESSMENT
THREAT VISIBILITY & VULNERABILITY ASSESSMENT Date: April 15, 2015 IKANOW Analysts: Casey Pence IKANOW Platform Build: 1.34 11921 Freedom Drive, Reston, VA 20190 IKANOW.com TABLE OF CONTENTS 1 Key Findings
Detecting Unknown Malware: Security Analytics & Memory Forensics. Fahad Ehsan. Cyber Security Researcher @memfors4all #RSAC
SESSION ID: ANF-T09 Detecting Unknown Malware: Security Analytics & Memory Forensics Fahad Ehsan Cyber Security Researcher @memfors4all Where it all Started ------------------------------------------------------------------------------------------
Cybersecurity Awareness. Part 1
Part 1 Objectives Discuss the Evolution of Data Security Define and Discuss Cybersecurity Review Threat Environment Part 1 Discuss Information Security Programs s Enhancements for Cybersecurity Risks Threat
Missing the Obvious: Network Security Monitoring for ICS
Missing the Obvious: Network Security Monitoring for ICS If ICS are so vulnerable, why haven t we seen more attacks? We aren t looking! Two Key Reasons Intent Visibility Intent Why are targeted attacks
Cybersecurity Best Practices
Ten Essential Cybersecurity Best Practices Banking Business Employees Brought to you by: 1 Did you know? One in five small-to-medium-sized companies were the victims of cyber breaches in 2013.1 In 76%
Information Security Engineering
Master of Science In Information Security Engineering Course Descriptions November 2014 Master of Science in Information Security Engineering The program of study for the Master of Science in Information
Protect Your Business and Customers from Online Fraud
DATASHEET Protect Your Business and Customers from Online Fraud What s Inside 2 WebSafe 5 F5 Global Services 5 More Information Online services allow your company to have a global presence and to conveniently
KASPERSKY SECURITY INTELLIGENCE SERVICES. EXPERT SERVICES. www.kaspersky.com
KASPERSKY SECURITY INTELLIGENCE SERVICES. EXPERT SERVICES www.kaspersky.com EXPERT SERVICES Expert Services from Kaspersky Lab are exactly that the services of our in-house experts, many of them global
ESG Threat Intelligence Research Project
TM Enterprise Strategy Group Getting to the bigger truth. ESG Threat Intelligence Research Project May 2015 Jon Oltsik, Senior Principal Analyst Project Overview 304 completed online surveys with IT professionals
Prepare Yourself for the Digital Battlefield. Christopher May. 27 Feb 2014
Prepare Yourself for the Digital Battlefield Christopher May 27 Feb 2014 2014 Carnegie Mellon University Overview Who is this guy? What is the Digital Battlefield? Why do I want to work in Cyber Security?
Evolution Of Cyber Threats & Defense Approaches
Evolution Of Cyber Threats & Defense Approaches Antony Abraham IT Architect, Information Security, State Farm Kevin McIntyre Tech Lead, Information Security, State Farm Agenda About State Farm Evolution
RSA Security Analytics
RSA Security Analytics This is what SIEM was Meant to Be 1 The Original Intent of SIEM Single compliance & security interface Compliance yes, but security? Analyze & prioritize alerts across various sources
SPSP Phase III Recruiting, Selecting, and Developing Secure Power Systems Professionals: Job Profiles
PNNL-24138 SPSP Phase III Recruiting, Selecting, and Developing Secure Power Systems Professionals: Job Profiles March 2015 LR O Neil TJ Conway DH Tobey FL Greitzer AC Dalton PK Pusey Prepared for the
Phishing Activity Trends Report June, 2006
Phishing Activity Trends Report, 26 Phishing is a form of online identity theft that employs both social engineering and technical subterfuge to steal consumers' personal identity data and financial account
Whose IP Is It Anyways: Tales of IP Reputation Failures
Whose IP Is It Anyways: Tales of IP Reputation Failures SESSION ID: SPO-T07 Michael Hamelin Lead X-Force Security Architect IBM Security Systems @HackerJoe What is reputation? 2 House banners tell a story
Applying machine learning techniques to achieve resilient, accurate, high-speed malware detection
White Paper: Applying machine learning techniques to achieve resilient, accurate, high-speed malware detection Prepared by: Northrop Grumman Corporation Information Systems Sector Cyber Solutions Division
Software that provides secure access to technology, everywhere.
Software that provides secure access to technology, everywhere. Joseph Patrick Schorr @JoeSchorr October, 2015 2015 BOMGAR CORPORATION ALL RIGHTS RESERVED WORLDWIDE 1 Agenda What are we dealing with? How
Phishing Activity Trends
Phishing Activity Trends Report for the Month of, 27 Summarization of Report Findings The number of phishing reports received by the (APWG) came to 23,61 in, a drop of over 6, from January s previous record
Cyber Watch. Written by Peter Buxbaum
Cyber Watch Written by Peter Buxbaum Security is a challenge for every agency, said Stanley Tyliszczak, vice president for technology integration at General Dynamics Information Technology. There needs
05 June 2015 A-000061-MW TLP: GREEN
05 June 2015 Alert Number A-000061-MW Please contact the FBI with any questions related to this FLASH Report at either your local Cyber Task Force or FBI CYWATCH. Email: cywatch@ic.fbi.gov Phone: 1-855-292-3937
GRC & Cyber Security Conference - Bringing the Silos Together ISACA Ireland 3 Oct 2014 Fahad Ehsan
Fahad Ehsan Cyber Security Researcher Where it all started. ------------------------------------------------------------------------------------------ Welcome to the Dungeon (c) 1986 Basit & Amjad (pvt)
ThreatSTOP Technology Overview
ThreatSTOP Technology Overview The Five Parts to ThreatSTOP s Service We provide 5 integral services to protect your network and stop botnets from calling home ThreatSTOP s 5 Parts: 1 Multiple threat feeds
Automate the Hunt. Rapid IOC Detection and Remediation WHITE PAPER WP-ATH-032015
Rapid IOC Detection and Remediation WP-ATH-032015 EXECUTIVE SUMMARY In the escalating war that is cyber crime, attackers keep upping their game. Their tools and techniques are both faster and stealthier
GOING BEYOND BLOCKING AN ATTACK
Websense Executive Summary GOING BEYOND BLOCKING AN ATTACK WEBSENSE TRITON VERSION 7.7 Introduction We recently announced several new advanced malware and data theft protection capabilities in version
Cyber intelligence in an online world
Cyber intelligence in an online world James Hanlon CISM, CISSP, CMI Cyber Strategy & GTM, EMEA Cyber intelligence in an online world SYMANTEC VISION SYMPOSIUM 2014 2 Software and data powers the world
Common Attack Pattern Enumeration and Classification CAPEC A Community Knowledge Resource for Building Secure Software
Common Attack Pattern Enumeration and Classification CAPEC A Community Knowledge Resource for Building Secure Software CAPEC is a publicly available catalog of attack patterns along with a comprehensive
Intel Security Certified Product Specialist Security Information Event Management (SIEM)
Intel Security Certified Product Specialist Security Information Event Management (SIEM) Why Get Intel Security Certified? As technology and security threats continue to evolve, organizations are looking