Managed Incident Lightweight Exchange (MILE)
|
|
|
- Luke Hopkins
- 8 years ago
- Views:
Transcription
1 Managed Incident Lightweight Exchange (MILE) Overview and Particpation Kathleen Moriarty Global Lead Security Architect EMC Corporate CTO Office 1
2 Agenda IETF s Managed Incident Lightweight Exchange (MILE) Charter & documents Data formats Transport How can I help? 2
3 Overview Updated Charter: Current list of documents: RFC5070-bis IODEF Enumeration Reference Format Structured Cybersecurity Information (SCI) IODEF Guidance RESTful indicator exchange using IODEF/RID 3
4 MILE: Solving Interoperable Exchanges Data Share, consume, process, and amend indicator and incident data Enable easy processing and use by Incident Management Systems, Security Information and Event Management systems (SIEM), intrusion detection systems, etc. Intelligence feeds for situational awareness Enable risk-based prioritization for remediation and defensive actions Provide not only a common format, but also an architecture and protocol exchange 4
5 Interoperable Data Formats 5
6 Consistent Data Representations Data exchanged, sent/received, with a consistent interpretation Well-defined data formats RFC5070, Incident Object Description Exchange Format (IODEF) under revision for v2.0, participation encouraged Sharing of indicator and incident information with context rich data for proactive and reactive remediation capabilities RFC5070-bis is in an edit cycle Outstanding issues tracked at: Discussions on feedback, comments, changes, additions encouraged! Fix internationaliztion Add better reference (citation) to RecordPattern at type=regex Review completeness of HistoryItem at action Review completeness Review completeness of Impact at type Add support for domain name meta data Add geolocation representation to Node/System Review completeness of recent additions in 5070-bis Review implementation of extending enumerated values Review all requirements key words (RFC 2119) Harmonize the specification for Reference with other WG activity Review completeness of NodeRole at category Define clear scope for the core data model relative to other WG documents and future extensions 6
7 Incident Object Description and Exchange Format (IODEF) Background Internet Engineering Task Force (IETF) Standard: RFC5070 Provides a standard format to describe a security incident Effort led by the CERT Coordination Center (CERT/CC) out of Carnegie Mellon University, IODEF started by TERENA Computer Security Incident Response Teams (CSIRTs) globally contributed to the development and evaluation of the Extensible Markup Language (XML) schema Assumptions Incidents are not IDS alarms Incidents are composed of events Agnostic to specific incident taxonomies Your definition/threshold of an incident may be different than mine Incidents are numbered and there is state kept about them Organizations assign incident IDs and have ticketing/handling/correlation systems that process them Merely a wire format Sharing is different than storage and archiving Incomplete information You may require more complete information than I need, can get, or have right now Some slide content from RSA Presentation: Roman Danyliw & Pat Cain 7
8 IODEF:Incident IODEF Data Model CSIRT Operations Incident identifiers Contact Information Internationalization Various Encodings Translations Data handling labels Sensitivity Confidence Extensibility of attributes and adding new elements Timing information Enumeration of hosts or networks e.g., IP addresses, ports, protocols, applications, etc. History and requested action Exploit and vulnerability references Impact expressed technically, financially, or by time Forensics information iodef:incidentid iodef:alternativeid iodef:relatedactivity iodef:detecttime iodef:starttime iodef:endtime iodef:reporttime iodef:assessment iodef:method iodef:contact iodef:eventdata iodef:history iodef:eventdata iodef:description iodef:detecttime iodef:starttime iodef:endtime iodef:contact iodef:assessment iodef:method iodef:flow iodef:expectation iodef:record iodef:eventdata iodef:additionaldata iodef:additionaldata 8
9 Feedback Requested Feedback encouraged on RFC5070-bis Structured Cyber Security draft IODEF Enumeration Reference Format We will need to determine if the SCI draft should get folded into RFC5070-bis Additional extensions may be submitted soon for specific use cases 9
10 Transport 10
11 RID Incident and Indicator Exchanges Communication and Searches from Providers & Trusted Entities Analysis Center Detection & Security Systems ROLIE Indicator System Incident Mgmt RID Sharing Group Trusted Entity Partner, Peer, Service Provider Copyright 2013 EMC Corporation. All rights 11
12 Protocols for Information Exchanges Peer-to-Peer, Push Model, High Assurance Exchanges RID RFC6545 & RFC6546 Repository Access Pull Model ROLIE Draft Node 1 Node 1 Node 1 Node 1 Hub 1 Node 1 Hub 1 Portal Social Network RSS Feeds Pub/Sub Model XMPP over RID Hub 2 12
13 Summary Taxonomy of cyber incident information is based on IODEF version 2 in the IETF In revision from 1.0, participation encouraged Transport enables multiple exchange types Peer-to-peer, push model Hub and spoke pull model Publish & subscribe Relies upon trust & assurance Identity, access management, and federation Secure collaboration with trusted entities at appropriate assurance levels 13
14 How Can I help? Participate in the IETF MILE working group: Meetings are held three times a year Next meeting: Berlin, Germany July 28 Aug 2, 2013 Participation can be in person or remote via MeetEcho All decisions are finalized on the mailing list Join MILE@ietf.org mailing list Participate in an existing thread Start a thread on any questions based on review of a draft Start a thread on work to be proposed related to MILE Contribute to open source code Provide feedback on code and associated RFCs and drafts Copyright 2013 EMC Corporation. All rights 14
15 Thank you! 15
16
17 Managed Incident Lightweight Exchange (MILE) Interoperable data exchanges A data model alone is not enough Consistent representations to ensure the recipient interprets the information as expected by the sender Flexible and extensible data model: Incident Object Description Exchange Format (IODEF) IODEF + extensions using AdditionalData or RecordItem classes IODEF + Structured Cybersecurity Information (SCI) registered data representations Flexible transports with consistent policy capabilities via Real-time Inter-network Defense (RID) Secure peer-to-peer (RID + HTTP/TLS binding) Hub-n-spoke (Resource Oriented Lightweight Indicator Exchange (ROLIE)) Federated access (RID + XMPP binding?) Transports flexible to carry IODEF or any other data model Copyright 2013 EMC Corporation. All rights 17
Managed Incident Lightweight Exchange (MILE): Standards for Cross- Domain Incident Handling
Managed Incident Lightweight Exchange (MILE): Standards for Cross- Domain Incident Handling Brian Trammell, ETH Zürich Co- chair, IETF MILE Working Group CollaboraKve Security and Privacy Technologies
Information Sharing Use Cases
Information Sharing Use Cases Effective Information Sharing: Lessons learned from Operator Experience Kathleen M. Moriarty Global Lead Security Architect EMC Office of CTO 1 What s New Text Is Title Case
John P. Field Security Architect Pivotal
ROLIE: Resource-Oriented Lightweight Indicator Exchange John P. Field Security Architect Pivotal 1 Agenda Motivation for ROLIE Use Case Examples Review of questions raised since draft -02 Additional Discussion
Internet-Draft Intended status: Informational Expires: April 20, 2016 October 18, 2015
MILE Internet-Draft Intended status: Informational Expires: April 20, 2016 C. Inacio CMU D. Miyamoto UTokyo October 18, 2015 MILE Implementation Report draft-ietf-mile-implementreport-06 Abstract This
Request for Comments: 3067 Category: Informational JANET-CERT Y. Demchenko TERENA J. Meijer SURFnet February 2001
Network Working Group Request for Comments: 3067 Category: Informational J. Arvidsson Telia CERT A. Cormack JANET-CERT Y. Demchenko TERENA J. Meijer SURFnet February 2001 TERENA s Incident Object Description
SHARING THREAT INTELLIGENCE ANALYTICS FOR COLLABORATIVE ATTACK ANALYSIS
SHARING THREAT INTELLIGENCE ANALYTICS FOR COLLABORATIVE ATTACK ANALYSIS Samir Saklikar RSA, The Security Division of EMC Session ID: CLE T05 Session Classification: Intermediate Agenda Advanced Targeted
Coordinating Attack Response at Internet Scale (CARIS)
Coordinating Attack Response at Internet Scale (CARIS) Overview and Summary Report July 2015 Kathleen Moriarty Security Area Director, IETF Kathleen.Moriarty.ietf@gmail.com Agenda Coordinating Attack Response
Open Source Incident Management Tool for CSIRTs
An Agency Under MOSTI Open Source Incident Management Tool for CSIRTs Adli Wahid Head, Malaysia CERT (MyCERT) CyberSecurity Malaysia Copyright 2008 CyberSecurity Malaysia Agenda About MyCERT Where do incidents
Ticketing system integration
Nordic Infrastructure for Research & Education Ticketing system integration 5 th TF-NOC meeting Dubrovnik 15/2-12 Stefan Liström Agenda Background Current problems and solutions Our idea and implementation
Attackers are reusing attacks (because they work)
The Problem Attackers are reusing attacks (because they work) Defenders are collecting and/or sharing information, but Often a manual process (copy-paste from a PDF) Different sources provide different
Threat Intelligence for Dummies. Karen Scarfone Scarfone Cybersecurity
Threat Intelligence for Dummies Karen Scarfone Scarfone Cybersecurity 1 Source Material Threat Intelligence for Dummies ebook Co-authored with Steve Piper of CyberEdge Group Published by Wiley Sponsored
National Initiative for Cybersecurity Education
THE NICE VISION National Initiative for Cybersecurity Education a national campaign to promote cybersecurity awareness and digital literacy from our boardrooms to our classrooms, and to build a digital
The STAGEnet Security Model
NDSU 2015 Cyber Security Conference The STAGEnet Security Model Peeling Away the Layers March 17, 2015 NDSU Memorial Union Rose Room NDSU 2015 Cyber Security Conference Art Bakke Enterprise Information
Cyber Security Information Exchange
Cyber Security Information Exchange Luc Dandurand NATO Communications and Information Agency Session ID: SECT-T08 Session Classification: General Interest Overview Cyber security in NATO Highlight of existing
Glasnost or Tyranny? You Can Have Secure and Open Networks!
AT&T is a proud sponsor of StaySafe Online Glasnost or Tyranny? You Can Have Secure and Open Networks! Steven Hurst CISSP Director - AT&T Security Services and Technology AT&T Chief Security Office 2009
RFC 2350 CSIRT-TEHTRIS [CERT-TEHTRIS]
![RFC 2350 CSIRT-TEHTRIS [CERT-TEHTRIS]](/thumbs/38/17892307.jpg "RFC 2350 CSIRT-TEHTRIS [CERT-TEHTRIS]")
RFC 2350 CSIRT-TEHTRIS [CERT-TEHTRIS] 1 Document information... 2 1.1 Date of Last Update... 2 1.2 Distribution List for Notifications... 2 1.3 Locations where this Document May Be Found... 2 1.4 Authenticating
defense through discovery
defense through discovery about krypton krypton is an advisory and consulting services firm, specialized in the domain of information technology (it) and it-related security krypton is a partnership amongst
Enterprise Organizations Need Contextual- security Analytics Date: October 2014 Author: Jon Oltsik, Senior Principal Analyst
ESG Brief Enterprise Organizations Need Contextual- security Analytics Date: October 2014 Author: Jon Oltsik, Senior Principal Analyst Abstract: Large organizations have spent millions of dollars on security
Vulnerability Assessment Report Format Data Model
I3E'2005 Vulnerability Assessment Report Format Data Model Dr.D.Polemi G.Valvis Issues Attack paradigm Vulnerability exploit life cycle Vulnerability assessment process Challenges in vulnerability assessment
Common Event Expression
Common Event Expression Architecture Overview Version 0.5 The CEE Editorial Board May 2010 Approved for Public Release; Distribution Unlimited. Case 10-2296 This page intentionally left blank. Acknowledgments
Effective IDS/IPS Network Security in a Dynamic World with Next-Generation Intrusion Detection & Prevention
Effective IDS/IPS Network Security in a Dynamic World with Next-Generation Intrusion Detection & Prevention Your Security Challenges Defending the Dynamic Network! Dynamic threats 䕬 䕬 䕬 䕬 Many threats
BREAKING THE KILL CHAIN AN EARLY WARNING SYSTEM FOR ADVANCED THREAT
BREAKING THE KILL CHAIN AN EARLY WARNING SYSTEM FOR ADVANCED THREAT Rashmi Knowles RSA, The Security Division of EMC Session ID: Session Classification: SPO-W07 Intermediate APT1 maintained access to
VRDA Vulnerability Response Decision Assistance
VRDA Vulnerability Response Decision Assistance Art Manion CERT/CC Yurie Ito JPCERT/CC EC2ND 2007 2007 Carnegie Mellon University VRDA Rationale and Design 2 Problems Duplication of effort Over 8,000 vulnerability
Secure Content Automation Protocol (SCAP): How it is increasingly used to automate enterprise security management activities
Secure Content Automation Protocol (SCAP): How it is increasingly used to automate enterprise security management activities Sean Barnum sbarnum@mitre.org September 2011 Overview What is SCAP? Why SCAP?
Leading The World Into Connected Security. Dipl.-Inform., CISSP, S+ Rolf Haas Enterprise Technology Specialist Content Lead EMEA
Leading The World Into Connected Security Dipl.-Inform., CISSP, S+ Rolf Haas Enterprise Technology Specialist Content Lead EMEA History of Defining Largest Dedicated Delivering a Next Generation Architecture
Quality Over Quantity
Presented by Rod Rasmussen June 16, 2015 FIRST Conference, Berlin Quality Over Quantity CUTTING THROUGH CYBERTHREAT INTELLIGENCE NOISE Rod Rasmussen IID founder, CTO Co-chair Anti- Phishing Working Group
CERT/CC Overview & CSIRT Development Team Activities
CERT/CC Overview & CSIRT Development Team Activities Georgia Killcrece CSIRT Development Team CERT Program Software Engineering Institute Carnegie Mellon University Pittsburgh, PA 15213-3890 October 2006
Incident Object Description and Exchange Format
Incident Object Description and Exchange Format TF-CSIRT at TERENA IODEF Editorial Group Jimmy Arvidsson Andrew Cormack Yuri Demchenko
W3C Meeting ISO/IEC/IEEE P21451-1-4
W3C Meeting ISO/IEC/IEEE P21451-1-4 1 st International Semantic Web 3.0 Standard for the Internet of Things (IoT) William J. Miller Chairman 07/22/2015 1 Internet of Things (IoT) http://www.sensei-iot.org
Configuring Security for SMTP Traffic
4 Configuring Security for SMTP Traffic Securing SMTP traffic Creating a security profile for SMTP traffic Configuring a local traffic SMTP profile Assigning an SMTP security profile to a local traffic
PALANTIR CYBER An End-to-End Cyber Intelligence Platform for Analysis & Knowledge Management
PALANTIR CYBER An End-to-End Cyber Intelligence Platform for Analysis & Knowledge Management INTRODUCTION Traditional perimeter defense solutions fail against sophisticated adversaries who target their
Security Vulnerability Management. Mark J Cox
Security Vulnerability Management Mark J Cox Responsibility & Accountability Unique challenges Many vendors all ship the same thing The vulnerabilities are there. The fact that somebody in the middle of
Security Content Automation Protocol for Governance, Risk, Compliance, and Audit
UNCLASSIFIED Security Content Automation Protocol for Governance, Risk, Compliance, and Audit presented by: Tim Grance The National Institute of Standards and Technology UNCLASSIFIED Agenda NIST s IT Security
TRANSFORMING EXPECTATIONS FOR THREAT-INTELLIGENCE SHARING
TRANSFORMING EXPECTATIONS FOR THREAT-INTELLIGENCE SHARING August 2013 Kathleen M. Moriarty Global Lead Security Architect, Corporate Office of the CTO EMC Corporation KEY POINTS Organizations today rely
What is Security Intelligence?
2 What is Security Intelligence? Security Intelligence --noun 1. the real-time collection, normalization, and analytics of the data generated by users, applications and infrastructure that impacts the
RID-DoS: Real-time Inter-network Defense Against Denial of Service Attacks. Kathleen M. Moriarty. MIT Lincoln Laboratory.
: Real-time Inter-network Defense Against Denial of Service Attacks Kathleen M. Moriarty 22 October 2002 This work was sponsored by the Air Force Contract number F19628-00-C-002. Opinions, interpretations,
Question(s): 4/17 Geneva, 16-25 September 2009 TEMPORARY DOCUMENT
INTERNATIONAL TELECOMMUNICATION UNION STUDY GROUP 17 TELECOMMUNICATION STANDARDIZATION SECTOR STUDY PERIOD 2009-2012 English only Original: English Question(s): 4/17 Geneva, 16-25 September 2009 Source:
Machine-to-Machine Exchange of Cyber Threat Information: a Key to Mature Cyber Defense
Machine-to-Machine Exchange of Cyber Threat Information: a Key to Mature Cyber Defense By: Daniel Harkness, Chris Strasburg, and Scott Pinkerton The Challenge The Internet is an integral part of daily
Internet Structure and Organization
Internet Structure and Organization Resources management and allocation Bernard.Tuy@renater.fr Introduction What s the Internet? Why organizations / bodies are needed? Define protocol specifications Agree
Agenda. What is Service Level Agreement (SLA)? Why using ONE tool for SLA management? What s New on the Market? Oblicore Guarantee.
SLA Management Agenda What is Service Level Agreement (SLA)? Why using ONE tool for SLA management? What s New on the Market? Oblicore Guarantee Overview Architecture Why Sytel Reply What s Next 2 Definition
THE TOP 4 CONTROLS. www.tripwire.com/20criticalcontrols
THE TOP 4 CONTROLS www.tripwire.com/20criticalcontrols THE TOP 20 CRITICAL SECURITY CONTROLS ARE RATED IN SEVERITY BY THE NSA FROM VERY HIGH DOWN TO LOW. IN THIS MINI-GUIDE, WE RE GOING TO LOOK AT THE
Rashmi Knowles Chief Security Architect EMEA
Rashmi Knowles Chief Security Architect EMEA AGENDA Transformation of IT New cyber-security challenges Intelligence Driven Security Security Analytics Q&A 2 ENTERPRISE DATA CENTER ADVANCED SECURITY A UNIQUE
Operational Lessons from the RSA/EMC CIRC: People, Process, & Threat Intel
Operational Lessons from the RSA/EMC CIRC: People, Process, & Threat Intel @Ben_Smith Ben Smith, CISSP Field CTO (US East), Security Portfolio A Security Maturity Path CONTROLS COMPLIANCE IT RISK BUSINESS
Security Coordination with IF-MAP
Security Coordination with IF-MAP Matt Webster, Lumeta 28 Sept 2010 Copyright 2010 Trusted Computing Group Agenda Threat Landscape and Federal Networks Recap of TNC Explanation of IF-MAP What is IF-MAP?
The Ontological Approach for SIEM Data Repository
The Ontological Approach for SIEM Data Repository Igor Kotenko, Olga Polubelova, and Igor Saenko Laboratory of Computer Science Problems, Saint-Petersburg Institute for Information and Automation of Russian
Creating and Managing Computer Security Incident Response Teams (CSIRTs)
Creating and Managing Computer Security Incident Response Teams (CSIRTs) CERT Training and Education Networked Systems Survivability Program Software Engineering Institute Carnegie Mellon University Pittsburgh,
CERT.AZ description as per RfC 2350
CERT.AZ description as per RfC 2350 Contact Cyber Security Center (CSC) Computer Emergency Response Team (CERT) Address Block 702, Drogal lane Baku, Azerbaijan Telephone: +99412 4932056 +99412 4932057
The MANTIS Framework Cyber-Threat Intelligence Mgmt. for CERTs Siemens AG 2014. All rights reserved
B. Grobauer, S.Berger, J. Göbel, T. Schreck, J. Wallinger Siemens CERT The MANTIS Framework Cyber-Threat Intelligence Mgmt. for CERTs Note MANTIS is available as Open Source under GPL v2+ from https://github.com/siemens/django-mantis
Advanced Threats: The New World Order
Advanced Threats: The New World Order Gary Lau Technology Consulting Manager Greater China gary.lau@rsa.com 1 Agenda Change of Threat Landscape and Business Impact Case Sharing Korean Incidents EMC CIRC
Network Monitoring for Cyber Security
Network Monitoring for Cyber Security Paul Krystosek, PhD CERT Network Situational Awareness 2006 Carnegie Mellon University What s Coming Up The scope of network monitoring Cast of characters Descriptions
The Importance of Cybersecurity Monitoring for Utilities
The Importance of Cybersecurity Monitoring for Utilities www.n-dimension.com Cybersecurity threats against energy companies, including utilities, have been increasing at an alarming rate. A comprehensive
Web Services Strategy
Web Services Strategy Agenda What What are are Web Web Services? Services? Web Web Services Services --The The Technologies Technologies Web Web Services Services Compliments Compliments Overall Overall
The SIEM Evaluator s Guide
Using SIEM for Compliance, Threat Management, & Incident Response Security information and event management (SIEM) tools are designed to collect, store, analyze, and report on log data for threat detection,
Symantec Cyber Threat Analysis Program Program Overview. Symantec Cyber Threat Analysis Program Team
Symantec Cyber Threat Analysis Program Symantec Cyber Threat Analysis Program Team White Paper: Symantec Security Intelligence Services Symantec Cyber Threat Analysis Program Contents Overview...............................................................................................
Protecting critical infrastructure from Cyber-attack
Protecting critical infrastructure from Cyber-attack ACI-NA BIT Workshop, Session 6 (Cybersecurity) Long Beach, California October 4, 2015 Ben Trethowan Aviation Systems & Security Architect The scale
L evoluzione del Security Operation Center tra Threat Detection e Incident Response & Management
L evoluzione del Security Operation Center tra Threat Detection e Incident Response & Management Security Services Architect & Advisor, IBM Italia Intervento al Security Summit Milano 2016 15 aprile Autore
DYNAMIC DNS: DATA EXFILTRATION
DYNAMIC DNS: DATA EXFILTRATION RSA Visibility Reconnaissance Weaponization Delivery Exploitation Installation C2 Action WHAT IS DATA EXFILTRATION? One of the most common goals of malicious actors is to
Q1 Labs Corporate Overview
Q1 Labs Corporate Overview The Security Intelligence Leader Who we are: Innovative Security Intelligence software company One of the largest and most successful SIEM vendors Leader in Gartner 2011, 2010,
WebRTC: Why and How? FRAFOS GmbH. FRAFOS GmbH Windscheidstr. 18 Ahoi 10627 Berlin Germany info@frafos.com www.frafos.com
WebRTC: Why and How? FRAFOS GmbH FRAFOS GmbH Windscheidstr. 18 Ahoi 10627 Berlin Germany info@frafos.com www.frafos.com This docume nt is copyright of FRAFOS GmbH. Duplication or propagation or e xtracts
Society, Law Enforcement and the Internet
Society, Law Enforcement and the Internet Models for Give-and-Take Carter Bullard CEO/President QoSient, LLC 150 E 57th Street Suite 12D New York, New York 10022 ICCS 2010 New York, New York carter@qosient.com
Security, Privacy, and the Effects of Ubiquitous Encryption. Kathleen Moriarty Security Area Director (Speaking for myself, not the IETF)
Security, Privacy, and the Effects of Ubiquitous Encryption Kathleen Moriarty Security Area Director (Speaking for myself, not the IETF) Motivation for Increased Privacy Protections BULLRUN/EDGEHILL RADON
IBM QRadar Security Intelligence April 2013
IBM QRadar Security Intelligence April 2013 1 2012 IBM Corporation Today s Challenges 2 Organizations Need an Intelligent View into Their Security Posture 3 What is Security Intelligence? Security Intelligence
Cyber Security. BDS PhantomWorks. Boeing Energy. Copyright 2011 Boeing. All rights reserved.
Cyber Security Automation of energy systems provides attack surfaces that previously did not exist Cyber attacks have matured from teenage hackers to organized crime to nation states Centralized control
FRAFOS GmbH Windscheidstr. 18 Ahoi 10627 Berlin Germany info@frafos.com www.frafos.com
WebRTC for Service Providers FRAFOS GmbH FRAFOS GmbH Windscheidstr. 18 Ahoi 10627 Berlin Germany info@frafos.com www.frafos.com This document is copyright of FRAFOS GmbH. Duplication or propagation or
Advanced Visibility. Moving Beyond a Log Centric View. Matthew Gardiner, RSA & Richard Nichols, RSA
Advanced Visibility Moving Beyond a Log Centric View Matthew Gardiner, RSA & Richard Nichols, RSA 1 Security is getting measurability worse Percent of breaches where time to compromise (red)/time to Discovery
RSA envision. Platform. Real-time Actionable Security Information, Streamlined Incident Handling, Effective Security Measures. RSA Solution Brief
RSA Solution Brief RSA envision Platform Real-time Actionable Information, Streamlined Incident Handling, Effective Measures RSA Solution Brief The job of Operations, whether a large organization with
Internationalization and Web Services
Internationalization and Web Services 25 th Internationalization and Unicode Conference Presented by Addison P. Phillips Director, Globalization Architecture webmethods, Inc. 25 th Internationalization
Virtual Team Collaboration Glossary
Virtual Team Collaboration Glossary Steve Prahst, Rhonda Arterberrie, and Dennis Kay Knowledge Management and Collaborative Technologies Branch NASA Glenn Research Center Introduction Most NASA projects
Monitoring for network security and management. Cyber Solutions Inc.
Monitoring for network security and management Cyber Solutions Inc. Why monitoring? Health check of networked node Usage and load evaluation for optimizing the configuration Illegal access detection for
Guideline on Auditing and Log Management
CMSGu2012-05 Mauritian Computer Emergency Response Team CERT-MU SECURITY GUIDELINE 2011-02 Enhancing Cyber Security in Mauritius Guideline on Auditing and Log Management National Computer Board Mauritius
XML Signatures in an Enterprise Service Bus Environment
XML Signatures in an Enterprise Bus Environment Eckehard Hermann Research & Development XML Integration Uhlandstraße 12 64297 Darmstadt, Germany Eckehard.Hermann@softwareag.com Dieter Kessler Research
After the Attack: RSA's Security Operations Transformed
After the Attack: RSA's Security Operations Transformed Ben Smith, CISSP RSA Field CTO (East), Security Portfolio Senior Member, ISSA Northern Virginia 1 The Environment ~ 2,000 security devices ~55M security
Federal Enterprise Architecture and Service-Oriented Architecture
Federal Enterprise Architecture and Service-Oriented Architecture Concepts and Synergies Melvin Greer Chief Strategist, SOA / Cloud Computing Certified Enterprise Architect Copyright August 19, 2010 2010
Information Risk Management. Alvin Ow Director, Technology Consulting Asia Pacific & Japan RSA, The Security Division of EMC
Information Risk Management Alvin Ow Director, Technology Consulting Asia Pacific & Japan RSA, The Security Division of EMC Agenda Data Breaches Required Capabilities of preventing Data Loss Information
White paper. Creating an Effective Security Operations Function
White paper Creating an Effective Security Operations Function Awareness of security issues is fundamental to an effective policy. When we think of a security operations center (SOC), we often have an
QRadar SIEM and FireEye MPS Integration
QRadar SIEM and FireEye MPS Integration March 2014 1 IBM QRadar Security Intelligence Platform Providing actionable intelligence INTELLIGENT Correlation, analysis and massive data reduction AUTOMATED Driving
A COMPLETE APPROACH TO SECURITY
A COMPLETE APPROACH TO SECURITY HOW TO ACHEIVE AGILE SECURITY OPERATIONS THREAT WATCH Cyber threats cost the UK economy 27 billion a year 200,000 new threats are identified every day 58% of businesses
ProtectWise: Shifting Network Security to the Cloud Date: March 2015 Author: Tony Palmer, Senior Lab Analyst and Aviv Kaufmann, Lab Analyst
ESG Lab Spotlight ProtectWise: Shifting Network Security to the Cloud Date: March 2015 Author: Tony Palmer, Senior Lab Analyst and Aviv Kaufmann, Lab Analyst Abstract: This ESG Lab Spotlight examines the
DNS Security Survey for National Computer Security Incident Response Teams December 2010
DNS Security Survey for National Computer Security Incident Response Teams December 2010 Summary As referenced during the ICANN meeting in Brussels, Belgium in June 2010, ICANN developed a survey on DNS
You ll learn about our roadmap across the Symantec email and gateway security offerings.
#SymVisionEmea In this session you will hear how Symantec continues to focus our comprehensive security expertise, global intelligence and portfolio on giving organizations proactive, targeted attack protection
Using SIEM for Real- Time Threat Detection
Using SIEM for Real- Time Threat Detection Presentation to ISSA Baltimore See and secure what matters Joe Magee CTO and Co-Founder March, 27 2013 About us Vigilant helps clients build and operate dynamic,
Romanian National Computer Security Incident Response Team CERT-RO. dan.tofan@cert-ro.eu http://www.cert-ro.eu
Romanian National Computer Security Incident Response Team CERT-RO dan.tofan@cert-ro.eu http://www.cert-ro.eu About A Digital Agenda for Europe, Pillar : Trust and Security, Action 38 Member States to
FRAFOS GmbH Windscheidstr. 18 Ahoi 10627 Berlin Germany info@frafos.com www.frafos.com
WebRTC for the Enterprise FRAFOS GmbH FRAFOS GmbH Windscheidstr. 18 Ahoi 10627 Berlin Germany info@frafos.com www.frafos.com This document is copyright of FRAFOS GmbH. Duplication or propagation or extracts
This presentation discusses the new support for the session initiation protocol in WebSphere Application Server V6.1.
This presentation discusses the new support for the session initiation protocol in WebSphere Application Server V6.1. WASv61_SIP_overview.ppt Page 1 of 27 This presentation will provide an overview of
Overview Commitment to Energy and Utilities Robert Held Sr. Systems Engineer Strategic Energy August 2015
Overview Commitment to Energy and Utilities Robert Held Sr. Systems Engineer Strategic Energy August 2015 Tripwire Evolution 18+ Years of Innovation 1997 Tripwire File System Monitoring from open source
CHAPTER 9: THE EVOLVING INTERNET
CHAPTER 9: THE EVOLVING INTERNET Multiple Choice: 1. What was the department of the U.S. government that developed the initial stages of the Internet? A. Department of Commerce B. Department of Defense
Security Analytics for Smart Grid
Security Analytics for Smart Grid Dr. Robert W. Griffin Chief Security Architect RSA, the Security Division of EMC robert.griffin@rsa.com blogs.rsa.com/author/griffin @RobtWesGriffin 1 No Shortage of Hard
Open Data Center Alliance Usage: Cloud Based Identity Governance and Auditing REV. 1.0
sm Open Data Center Alliance Usage: Cloud Based Identity Governance and Auditing REV. 1.0 Table of Contents Legal Notice... 3 Executive Summary... 4 Purpose... 5 Reference Framework... 5 Context... 6 Applicability...
Situational Awareness A Discussion
Situational Awareness A Discussion Dean Weber March, 2012 The Current Situation take one spending incidents financial losses overall risk grows resources applied grows but no real progress The situation
RSA Security Anatomy of an Attack Lessons learned
RSA Security Anatomy of an Attack Lessons learned Malcolm Dundas Account Executive John Hurley Senior Technology Consultant 1 Agenda Advanced Enterprise/ Threats The RSA Breach A chronology of the attack
7 Homeland. ty Grant Program HOMELAND SECURITY GRANT PROGRAM. Fiscal Year 2008
U.S. D EPARTMENT OF H OMELAND S ECURITY 7 Homeland Fiscal Year 2008 HOMELAND SECURITY GRANT PROGRAM ty Grant Program SUPPLEMENTAL RESOURCE: CYBER SECURITY GUIDANCE uidelines and Application Kit (October
IBM SECURITY QRADAR INCIDENT FORENSICS
IBM SECURITY QRADAR INCIDENT FORENSICS DELIVERING CLARITY TO CYBER SECURITY INVESTIGATIONS Gyenese Péter Channel Sales Leader, CEE IBM Security Systems 12014 IBM Corporation Harsh realities for many enterprise
McAfee - Overview. Anthony Albisser
McAfee - Overview Anthony Albisser Channel Account Manager About McAfee Founded in 1987, McAfee is now the world s largest dedicated security company (acquired by Intel in 2011) Global research for real-time
Securing Big Data Learning and Differences from Cloud Security
Securing Big Data Learning and Differences from Cloud Security Samir Saklikar RSA, The Security Division of EMC Session ID: DAS-108 Session Classification: Advanced Agenda Cloud Computing & Big Data Similarities
Cyber Information-Sharing Models: An Overview
PARTNERSHIP Cyber Information-Sharing Models: An Overview October 2012. The MITRE Corporation. All rights reserved. Approved for Public Release. Case Number 11-4486. Distribution Unlimited. Table of Contents
By: Gerald Gagne. Community Bank Auditors Group Cybersecurity What you need to do now. June 9, 2015
Community Bank Auditors Group Cybersecurity What you need to do now June 9, 2015 By: Gerald Gagne MEMBER OF PKF NORTH AMERICA, AN ASSOCIATION OF LEGALLY INDEPENDENT FIRMS 2015 Wolf & Company, P.C. Cybersecurity
Insider Threat Control: Using a SIEM signature to detect potential precursors to IT Sabotage. CERT Insider Threat Center
Insider Threat Control: Using a SIEM signature to detect potential precursors to IT Sabotage CERT Insider Threat Center April 2011 NOTICE: THIS TECHNICAL DATA IS PROVIDED PURSUANT TO GOVERNMENT CONTRACT
CYBER SECURITY OPERATIONS CENTRE
CYBER SECURITY OPERATIONS CENTRE Security Monitoring for protecting Business and supporting Cyber Defense Strategy Dr Cyril Onwubiko Intelligence & Security Assurance Research Series Limited CYBER SECURITY
How To Manage Security On A Networked Computer System
Unified Security Reduce the Cost of Compliance Introduction In an effort to achieve a consistent and reliable security program, many organizations have adopted the standard as a key compliance strategy
FIPA agent based network distributed control system
FIPA agent based network distributed control system V.Gyurjyan, D. Abbott, G. Heyes, E. Jastrzembski, C. Timmer, E. Wolin TJNAF, Newport News, VA 23606, USA A control system with the capabilities to combine