(S2.3) Security Spotlight: How cyber criminals can steal millions in seconds and how to fight back. Johannesburg

Transcription

1 (S2.3) Security Spotlight: How cyber criminals can steal millions in seconds and how to fight back Johannesburg

2 Bharat Mistry Security Chief Technologist HP Enterprise Security

3 Tweet using #HPWorldZA Johannesburg

4 In Hours, Thieves Took $45 Million in A.T.M. Scheme Sony drops PSN breach appeal after risk assessment Executive order leads to 'build it right' security guidelines Paul Christman, Special for CyberTruth 10:38 a.m. EDT July 10, 2013 Every day, the federal government is faced with the task of protecting vital data and assets for our nation's security. The need for a strong cybersecurity framework and resilient protection against attacks was amplified in 2012, when federal agencies reported nearly 50,000 incidents of cyber attacks. PlayStation creator decides to pay hefty fine for 2011 data breach, cites confidentiality of network security as reason for walking away from appeal By Steve Ragan, Staff Writer July 15, 2013 Thumb Drive Security: Snowden 1, NSA 0 Mathew J. Schwartz Thumb drives helped NSA whistle-blower Edward Snowden transport top-secret data from the agency. If the NSA can't keep a lid on thumb drives, can you? D'OH! Use Tumblr on iphone or ipad, give your password to the WORLD By John Leyden, July 2013 Tumblr's ios app fails to log users in through a secure (SSL) server, it has emerged. As a result users' plaintext passwords are exposed to anyone able to sniff traffic on any Wi-Fi network an ios user happens to use to connect to the popular cats'n'grumble freecontent platform. 4

5 5

6 6

7 7

8 8

9 Challenges you are facing 1 Nature and motivation of attacks (Fame to fortune, market adversary) Research Infiltration Exfiltration Discovery Capture Delivery Transformation of enterprise IT Traditional DC Private cloud Managed cloud Public cloud 2 (Delivery and consumption changes) Consumption Virtual desktops Notebooks Tablets Smart phones Regulatory pressures Basel III 3 (Increasing cost and complexity) 9

10 HACKTIVIST 10

11 ORGANIZE SPECIALIZE MONETIZE 11

12 12

13 13

14 HP Security Research Innovative research Ecosystem partner SANS, CERT, NIST, OSVDB, software, and reputation vendors ~3000 researchers customers sharing data managed networks globally Actionable security intelligence HP Security Research ESS Automatically integrated into HP products HP finds more vulnerabilities than the rest of the market combined Top security vulnerability research organization for the past three years Frost & Sullivan Thought leadership 14

15 15

16 HP TippingPoint protects users, apps and data with market leading network security SFDC Box Google 16

17 HP TippingPoint protects users, apps and data with market leading network security Simple Easy-to-use, configure and install with centralized management Effective Industry leading security intelligence with weekly DVLabs updates Reliable NGIPS with % network uptime track record 17

18 Gartner Leadership Quadrant 2013 HP TippingPoint has been in the leadership quadrant 9 years in a row! The TippingPoint IPS products have a broad model range of purpose-built appliances, and are known for low latency and high throughput. Customers often cite ease of installation as a positive in product evaluations, especially for deployments with many devices. 18

19 Swiss Federal Railways After a rigorous open bid process with lab tests utilizing our own network traffic, we selected the HP TippingPoint Next Generation IPS 7500NX. We searched for an IPS with minimal administrative effort, and this solution allows us to protect our network infrastructure using TippingPoint s easy-to-use but powerful security policies. Erwin Jud, Lead Engineer for IPS Project 19

20 84% of breaches occur at the application layer 9/10 mobile applications are vulnerable to attack 20

21 HP Fortify helps you protect your applications In-house Outsourced Commercial Open source Application assessment Software security assurance Application protection Assess Find security vulnerabilities in any type of software Assure Fix security flaws in source code before it ships Protect Fortify applications against attack in production 21

22 HP Fortify named leader in Gartner AST MQ HP Fortify has been named a leader in the Gartner 2013 Magic Quadrant for Application Security Testing (AST), a position it has held in every application security Magic Quadrant Gartner has ever issued. Gartner acknowledged Fortify s years of successful market execution and continued innovation by scoring it highest in completeness of vision and near the top in ability to execute. 22

23 SAP Enterprise software Client outcome Significantly enhanced the security of SAP software, with increased number of security patches since 2010 Met board requirements for product security Protected revenue-generating applications and customer reputation 23

24 Novagalicia Banco HP Fortify on Demand not only helps us improve application quality in terms of security, it also increases our developers awareness of security issues and use of best practices a key component of PCI compliance. Roberto Baratta, CISO Novagalicia Banco 24

25 25

26 days average time to detect breach 2013 January February March April May June July August September October November December 2014 January February March April 26

27 Security is complex, ArcSight helps you. Get Control Get Efficient Get Compliant Transform Big Data into actionable security intelligence Faster resolution with fewer resources Automate your compliance out-of-the box 27

28 The #1 real time security correlation platform Comprehensive solution for data collection from 350+ log generating sources 28

29 HP ArcSight named leader in Gartner SIEM MQ 2013 HP ArcSight named a leader in the Gartner Magic Quadrant for Security Information and Event Management (SIEM), 10 years in a row. The most visionary product in the Gartner SIEM MQ 29

30 Vodafone Telecommunications We receive 550 million events per week from our security systems. Due to the aggregation and correlation capabilities of HP ArcSight ESM, those events are reduced to about 50,000 prioritized events. That s an efficiency factor of 1 to 11,000! Manfred Troeder, Head of Global Security Operations Center 30

31 31

32 HP Atalla secures data and payments Protecting customers, mitigating risk, and supporting compliance requirements with leading technology for encryption and key management Reliable High performance cryptography and key management for card payments and data protection Secure Cryptographic keys and operations are protected by FIPS validated solutions Compliant Solutions support government and financial industry standards 32

33 HP HAVEn helps you monitor the assets that matter HP ArcSight with IDOL People generate data IDOL Machines generate data ESM 33

34 34

35 Since 2009, time to resolve an attack has grown % 35

36 2/5 on maturity continuum 24% fail to meet security requirements 30% fail to meet compliance 36

37 Delivering capabilities for our clients Disrupt the adversary, manage risk, and extend clients capabilities Disrupt the adversary Manage risk Extend your your capabilities Security Technology Stop internal and external adversaries Real-time threat disruption Crowd sourced security intelligence Security Consulting Reduce complexity and risk Security assessment to achieve compliance Access to HP s 5,000 security specialists Managed Security Services Respond faster to security incidents Improve risk posture Global and local standards knowledge 37

38 HP Security: Helping customers manage risk Offerings to strengthen security posture, proactively manage incidents, and extend security capabilities 38

39 Providing enterprise-level security focus Security Consulting Expertise to help clients understand, manage, and reduce business and security risks 39

40 Security Consulting: Manage risk and compliance HP Security Consulting provides expertise to help you gain deeper understanding of your security posture, identify security risks that will impact organizational objectives, and manage them to reduce complexity and harden your defenses. 40

41 HPs next-gen SOCs provide 24*7 monitoring & management Features of SOC and HP MSS: 24*7*365 monitoring + management capability Local knowledge for regional regulatory support Integration into a global threat profile with collaboration + communication across SOCs Targeted Threat Intelligence via the HP MSS Portal 41 Client benefits: Helps alleviate the burden on constrained resources Improved intelligence sharing and response to threats Better identification and faster response to incidents For quicker restoration time and reduced impact on the organisation

42 HP Services provides quick, effective breach response Enterprise Security Services Get deep visibility and take action to address and stop attacks Deploy remediating products fast Integration with Breach Response Services 42

43 HPs footprint: Industry leading scale 43

44 HP s industry-leading scale 9 Major banks out of out of 10 Top telecoms All major branches US Department of Defense 9 out of 10 Top software companies HP Security Professionals 47m HP Secured User Accounts 44 23billion Monthly security events HP managed security customers

45 Thank You

46 Tweet using #HPWorldZA Johannesburg