Security OperaCons with Splunk App for Enterprise Security
|
|
|
- Jack Tucker
- 9 years ago
- Views:
Transcription
1 Copyright 2014 Splunk Inc. Security OperaCons with Splunk App for Enterprise Security David Casey, Vice President, IT Security OperaCons Manager Flagstar Bank
2 Disclaimer During the course of this presentacon, we may make forward- looking statements regarding future events or the expected performance of the company. We caucon you that such statements reflect our current expectacons and escmates based on factors currently known to us and that actual events or results could differ materially. For important factors that may cause actual results to differ from those contained in our forward- looking statements, please review our filings with the SEC. The forward- looking statements made in the this presentacon are being made as of the Cme and date of its live presentacon. If reviewed aser its live presentacon, this presentacon may not contain current or accurate informacon. We do not assume any obligacon to update any forward- looking statements we may make. In addicon, any informacon about our roadmap outlines our general product direccon and is subject to change at any Cme without nocce. It is for informaconal purposes only, and shall not be incorporated into any contract or other commitment. Splunk undertakes no obligacon either to develop the features or funcconality described or to include any such feature or funcconality in a future release. 2
3 Personal Background! CISSP/CISM/SnortCP/Dr.Evil! Joined Flagstar Bank in early 2013! 15+ Yrs IT Security! 18 Yrs U.S. Army Military Intelligence Experience in the following sectors:! DoD (Lockheed MarCn, NCI, SAIC)! EducaCon! Energy! Finance Specialize in building Security OperaCons programs from the ground up and major security ops overhauls due to compliance failures 3
4 Company Background Flagstar Bank! Full- service bank (Troy, Michigan)! $9.4 billion in total assets! Branches in Michigan! 39 Home loan centers in 19 states! NaConwide mortgage lender! One of the nacon's top 10 largest savings banks 4
5 In the Beginning There was Darkness! Flagstar expanded business operacons very fast! Infrastructure changes, mind sets, technology could not keep pace! As Flagstar bank grew federal oversight shised! New auditors were assessing security in the same manner as the Chase s and Bank of America s! Flagstar had many, many audit findings! People, processes, and technology had to change! IT Security OperaCons grew significantly in order to meet compliance requirements effeccvely! A SIEM was a criccal component! The One Ring to rule them all! 5
6 SIEM Technology Decision When looking for a SIEM solu7on for Flagstar leveraged 12+ years of SIEM deployment experience as its guide. Lessons learned: Difficult geong data in (ingescng data) Hard to get clear results from ad- hoc queries Limited plaporm opcons Costly to operate/maintain Inflexible SIEM sales hype. Product vendors only want to sell you their product. No interest in truly helping you protect your organizacon. Splunk Experience ü Easy to get all machine data into the system ü Simple plain language search ü Uses commodity hardware ü IntuiCve, easy to use ü Flexible and easy to customize ü They actually want you to be successful and take great strides to make it so! 6
7 Splunk Deployment Current Design:! 2 Search heads, 3 indexers, 300+ GB/day! Data sources (current) All servers via forwarders Windows, 4 flavors of UNIX All networking devices (switch, router, wireless, VPN, etc.) Syslog systems Firewall, IPS, DLP, AnC- Virus Web proxy logs DNS, DHCP Applica7ons Splunk for Windows apps (3) Splunk for UNIX app Various vendor security apps (<10) DBConnect More 7
8 Splunk Deployment Disaster Recovery (DR) Design:! Overall Splunk ecosystem managed from HQ site! 2 Search heads, 2 indexers! DR site forwards all logs to HQ site! HQ replicates last 72 hours of logs to DR Future State:! All data 100% replicated! Heavy Forwarders Deployed to both HQ and DR sites! SAN improvements >1000 IOPS sustained 8
9 Security OperaCons Monitoring Challenges Some7mes security technology is simply not enough it takes a human to help it all make sense! The cyber security threat landscape is constantly morphing, ever changing, with threat actors intent on by- passing common security controls that rely on known payerns and deteccon techniques! Humans are primarily a visual- based species! Splunk can provide a visual that speaks a thousand words by taking the complex and making it simple to understand! Take for instance the following case studies 9
10 Case Study #1 Are We Being Targeted?! Flagstar s IT Security OperaCons Team uses the Splunk Enterprise Security (ES) App to monitor for advance threats, including exploits, malware infeccons, monitoring blacklists, and responding to spikes in threat trends! One common threat gathering technique is finger princng/mapping out a targets public facing systems, its ports and services! Being scanned is very common and generally considered background noise just a part of doing business on the internet! But when the scan is coming from a country that is frequently a hoscle cyber threat, and the scan is performed slowly, non- aggressively, it can osen by- pass security controls that are designed to block more aggressive scans 10
11 Case Study #1 Are We Being Targeted?! Sample Splunk search:sourcetype="[hidden]" earliest=- 1m inbound geoip src search src_country_code!=us stats count AS count by src_country_name sort - count top limit=5 11
12 Case Study #1 Are We Being Targeted?! Upon closer inspeccon we were able to isolate the scans as originacng from the City of Nanning, China! We have no legicmate customers in China! Answer? Block the network range 12
13 Case Study #1 Con$nued There are many hoscle actors all over the world. Some of the top actors are Russia, Ukraine, and China. Take Russia for example. Sure seems like there are a lot of outgoing conneccons to a Russian IP address. Could this be a compromised host? Using Splunk we can watch closely outbound descnacons, by IP locacon, and respond more quickly when we see an increase in potencally risky IP traffic to known hoscle actor countries. 13
14 Case Study #1 Con$nued! Sample Splunk search (Russia Inbound): sourcetype= [hidden]" src_ip!= [internal networks excluded]" iplocacon src_ip search Country="Russia" where Country="Russia" chart count by src_ip sort - count top limit=5! Sample Splunk search (Russia Outbound): sourcetype= [hidden]" src_ip!=[exclude DNS server IP, web proxies, etc.] " iplocacon dest_ip search Country="Russia" where Country="Russia" stats count by src_ip,dest_ip rename src_ip AS "Client" dest_ip AS "Russia IP Address" count AS "Count" table Client,"Russia IP Address",Count sort - count by Count top limit=5 14
![Sample Splunk search (Russia Outbound): sourcetype= [hidden]" src_ip!=[exclude DNS server IP, web proxies, etc.](/docs-images/42/19241320/images/page_14.jpg "] \" iplocacon dest_ip search Country=\"Russia\" where Country=\"Russia\" stats count by src_ip,dest_ip rename src_ip AS \"Client\" dest_ip AS \"Russia IP")
15 Case Study #2 Firewall Control AyestaCon! Flagstar s IT Security OperaCons Team uses the Splunk Enterprise Security (ES) app to help meet regulatory requirements (for IT Security Dept. only at this Cme)! One example was where federal auditors wanted to see where changes to the perimeter firewall were being monitored against approved firewall changes! If a change occurred outside of the change control process it should be noted and invescgated! Splunk was used to help idencfy all write and execute commands issued on the perimeter firewalls and graphically displayed for easy idencficacon! This solucon was accepted by the federal auditors! YMMV 15
16 Case Study #2 Firewall Control AyestaCon! Sample Splunk search: evenyype= [hidden]_privileged_accvity" "write" OR "111010" OR "101008" NOT ("Teardown" OR "conneccon" OR "exit" OR "ping" OR [hidden]") Cmechart span=15m count(host) by user sort _Cme 16
17 Case Study #3 Metrics Across Security Technologies! Flagstar s IT Security OperaCons Team uses the Splunk Enterprise Security (ES) App to track security metrics! Security metrics are commonly requested as *proof* that the $$$ invested in security technology is actually producing results! Rather then running separate reports from each security technology to determine the metrics, using Splunk simplified the process greatly! Remember that a picture tells a thousand words 17
18 Case Study #3 Metrics Across Security Technologies! Sample Splunk search (IPS): index=[hidden] sourcetype=[hidden] rec_type_simple="ips EVENT" Cmechart span=1mon count 18
![Sample Splunk search (IPS): index=[hidden]](/docs-images/42/19241320/images/page_18.jpg "sourcetype=[hidden] rec_type_simple=\"ips")
19 Case Study #4 24 x 7 Monitoring! Flagstar s IT Security OperaCons Team uses the Splunk Enterprise Security (ES) app to provide 24x7 monitoring! Instead of spending $$$ on an external Managed Security Services provider that provides aser hours support, Splunk can be used to develop acconable dashboards monitored by the internal Network OperaCons Support Team (which works 24x7)! PotenCal savings can go towards other criccal security budget items NOTE: This case study is currently being developed and tested within Flagstar. It has not yet reached a point where it is ready to replace an external MSS provider 19
20 Case Study #4 24x7 Monitoring! Sample Splunk search: Available upon request 20
21 Case Study #5! Flagstar s IT Security OperaCons Team uses the Splunk Enterprise Security (ES) app to detect `Brute Force Login Ayempts and send automated alerts in real- Cme when detected 21
22 Case Study #6! Flagstar s IT Security OperaCons Team uses the Splunk Enterprise Security (ES) app to detect `Malware InfecCons and send automated alerts in real- Cme when detected 22
23 Case Study #5 & 6! Sample Splunk search (Brute Force Ayempt Alert): EventCode=4625 sourcetype="wineventlog:security" earliest=- 6m latest=now bucket _Cme span=5m stats count by _Cme, Account_Name, src_ip,dest where count > 500! Sample Splunk search (Malware Alert): index=[hidden] sourcetype=[hidden] NOT ("Actual accon: Cleaned*" OR "Actual accon: QuaranCned" OR "Actual accon: Deleted") rename "event_cme" as "Detected" actual_accon as "AcCon" dest_nt_host as "Host" dest_ip as "Host IP" user as "User" risk_type as "DetecCon Type" signature as "Malware Name" table "Detected" "Host" "Host IP" "User" "DetecCon Type" "Malware Name" "AcCon" sort by "Detected" 23
24 The Future of Flagstar! We re planning to bring addiconal data into Splunk over the next 12 months Database logs & custom applicacon server logs Wide range of banking applicacons and regulatory data Endpoint (client) systems Third party hosted logs (various)! Explore the value of the prediccve analysis capability! Bring in Splunk Pro Services periodically to assist in maximizing Splunk's investment and to perform Splunk health checks 24
25 Ques7ons? Flagstar IT Security Opera7ons (SecOps) Team 25
26 Learn, share and hack Security office hours: 11:00 AM 2: Everyday Geek out, share ideas with Enterprise Security developers Red Team / Blue Team - Challenge your skills and learn new tricks Mon- Wed: 3:00 PM 6:00 Community Lounge Thurs: 11:00 AM 2:00 PM Birds of a feather- Collaborate and brainstorm with security ninjas Thurs: 12:00 PM 1:00 Room 26
27 THANK YOU
Threat Intelligence: STIX and Stones Will Break Your Foes
Copyright 2014 Splunk Inc. Threat Intelligence: STIX and Stones Will Break Your Foes Fred Wilmot Director, Global Security PracCce Brad Lindow a.k.a. Superman Global Security Strategist, Splunk Disclaimer
Workflow ProducCvity in Splunk Enterprise
Copyright 2013 Splunk Inc. Workflow ProducCvity in Splunk Enterprise Carl Yestrau Sr. So
Stalking Hackers with Core Splunk. Derek Arnold, CISSP Senior Splunk Consultant
Stalking Hackers with Core Splunk Derek Arnold, CISSP Senior Splunk Consultant Your Presenter Derek Arnold 12 years in security Enterprise IT Industries: Retail, medical tech, health insurance Specialties:
SANS Top 20 Critical Controls for Effective Cyber Defense
WHITEPAPER SANS Top 20 Critical Controls for Cyber Defense SANS Top 20 Critical Controls for Effective Cyber Defense JANUARY 2014 SANS Top 20 Critical Controls for Effective Cyber Defense Summary In a
Critical Controls for Cyber Security. www.infogistic.com
Critical Controls for Cyber Security www.infogistic.com Understanding Risk Asset Threat Vulnerability Managing Risks Systematic Approach for Managing Risks Identify, characterize threats Assess the vulnerability
Honeypots & Honeynets Overview. Adli Wahid Security Specialist, APNIC.net [email protected]
Honeypots & Honeynets Overview Adli Wahid Security Specialist, APNIC.net [email protected] 1 Contents 1. ObjecCves 2. DefiniCon of Honeypot & Honeynets 3. Benefits & Risk consideracon 4. Example of Honeypot
Intrusion Detection and Cyber Security Monitoring of SCADA and DCS Networks
Intrusion Detection and Cyber Security Monitoring of SCADA and DCS Networks Dale Peterson Director, Network Security Practice Digital Bond, Inc. 1580 Sawgrass Corporate Parkway, Suite 130 Sunrise, FL 33323
Enterprise Organizations Need Contextual- security Analytics Date: October 2014 Author: Jon Oltsik, Senior Principal Analyst
ESG Brief Enterprise Organizations Need Contextual- security Analytics Date: October 2014 Author: Jon Oltsik, Senior Principal Analyst Abstract: Large organizations have spent millions of dollars on security
WHITE PAPER SPLUNK SOFTWARE AS A SIEM
SPLUNK SOFTWARE AS A SIEM Improve your security posture by using Splunk as your SIEM HIGHLIGHTS Splunk software can be used to operate security operations centers (SOC) of any size (large, med, small)
Splunk: Using Big Data for Cybersecurity
Next Session Begins at 14:40 Splunk: Using Big Data for Cybersecurity Joe Goldberg Splunk Splunk: Using Big Data for Cybersecurity Joseph Goldberg Splunk Advanced Threats in the Headlines Cyber Criminals
Find the needle in the security haystack
Find the needle in the security haystack Gunnar Kristian Kopperud Principal Presales Consultant Security & Endpoint Management Technology Day Oslo 1 Find the needle in the security haystack Manually deep
Honeywell Industrial Cyber Security Overview and Managed Industrial Cyber Security Services Honeywell Process Solutions (HPS) June 4, 2014
Industrial Cyber Security Overview and Managed Industrial Cyber Security Services Process Solutions (HPS) June 4, Industrial Cyber Security Industrial Cyber Security is the leading provider of cyber security
Enabling Security Operations with RSA envision. August, 2009
Enabling Security Operations with RSA envision August, 2009 Agenda What is security operations? How does RSA envision help with security operations? How does RSA envision fit with other EMC products? If
Wasting Money on the Tools? Automating the Most Critical Security Controls. Mason Brown Director, The SANS Institute
Wasting Money on the Tools? Automating the Most Critical Security Controls Bonus: Gaining Support From Top Managers for Security Investments Mason Brown Director, The SANS Institute The Most Trusted Name
Concierge SIEM Reporting Overview
Concierge SIEM Reporting Overview Table of Contents Introduction... 2 Inventory View... 3 Internal Traffic View (IP Flow Data)... 4 External Traffic View (HTTP, SSL and DNS)... 5 Risk View (IPS Alerts
Introduction. Jason Lawrence, MSISA, CISSP, CISA Manager, EY Advanced Security Center Atlanta, Georgia [email protected] Twitter: @ethical_infosec
Introduction Jason Lawrence, MSISA, CISSP, CISA Manager, EY Advanced Security Center Atlanta, Georgia [email protected] Twitter: @ethical_infosec More than 20 years of experience in cybersecurity specializing
State of SIEM Challenges, Myths & technology Landscape 4/21/2013 1
State of SIEM Challenges, Myths & technology Landscape 4/21/2013 1 Introduction What s in a name? SIEM? SEM? SIM? Technology Drivers Challenges & Technology Overview Deciding what s right for you Worst
Security Information & Event Management (SIEM)
Security Information & Event Management (SIEM) Peter Helms, Senior Sales Engineer, CISA, CISSP September 6, 2012 1 McAfee Security Connected 2 September 6, 2012 Enterprise Security How? CAN? 3 Getting
How To Connect Log Files To A Log File On A Network With A Network Device (Network) On A Computer Or Network (Network Or Network) On Your Network (For A Network)
SIEM FOR BEGINNERS EVERYTHING YOU WANTED TO KNOW ABOUT LOG MANAGEMENT BUT WERE AFRAID TO ASK www.alienvault.com A Rose By Any Other Name SLM/LMS, SIM, SEM, SEC, SIEM Although the industry has settled on
Application for Splunk Enterprise
Application for Splunk Enterprise User Guide Document Version 1.77 28 October 2015 10004-01 EN Rev. A 2015 ThreatConnect, Inc. ThreatConnect is a registered trademark of ThreatConnect, Inc. UNIX is a registered
Defending Against Data Beaches: Internal Controls for Cybersecurity
Defending Against Data Beaches: Internal Controls for Cybersecurity Presented by: Michael Walter, Managing Director and Chris Manning, Associate Director Protiviti Atlanta Office Agenda Defining Cybersecurity
Performing Advanced Incident Response Interactive Exercise
Performing Advanced Incident Response Interactive Exercise Post-Conference Summary Merlin Namuth Robert Huber SCENARIO 1 - PHISHING EMAILS... 3... 3 Mitigations... 3 SCENARIO 2 - IDS ALERT FOR PSEXEC...
Secret Server Splunk Integration Guide
Secret Server Splunk Integration Guide Table of Contents Meeting Information Security Compliance Mandates: Secret Server and Splunk SIEM Integration and Configuration... 1 The Secret Server Approach to
Verve Security Center
Verve Security Center Product Features Supports multiple control systems. Most competing products only support a single vendor, forcing the end user to purchase multiple security systems Single solution
ORGANIZADOR: APOIANTE PRINCIPAL:
ORGANIZADOR: APOIANTE PRINCIPAL: Miguel Gomes 912412885 [email protected] Alliances Portugal, Africa, Brasil Coverage One of the biggest CSP worlwide Tec. Inovator Strong Cloud Bet and investment
Vulnerability Management with the Splunk App for Enterprise Security
Copyright 2014 Splunk Inc. Vulnerability Management with the Splunk App for Enterprise Security Randal T. Rioux Principal Security Strategist and Minister of Offense Splunk Inc. Disclaimer During the course
Information Technology Solutions
Managed Services Information Technology Solutions A TBG Security Professional Services Offering LET TBG MANAGE YOUR INFRASTRUCTURE WITH CONFIDENCE: TBG S INTEGRATED IT AUTOMATION FRAMEWORK PROVIDES: Computer
Splunk Cloud as a SIEM for Cybersecurity CollaboraFon
Copyright 2015 Splunk Inc. Splunk Cloud as a SIEM for Cybersecurity CollaboraFon Timothy Lee CISO, City of Los Angeles Disclaimer During the course of this presentafon, we may make forward looking statements
Palo Alto Networks and Splunk: Combining Next-generation Solutions to Defeat Advanced Threats
Palo Alto Networks and Splunk: Combining Next-generation Solutions to Defeat Advanced Threats Executive Summary Palo Alto Networks strategic partnership with Splunk brings the power of our next generation
CONTINUOUS DIAGNOSTICS BEGINS WITH REDSEAL
CONTINUOUS DIAGNOSTICS BEGINS WITH REDSEAL WHAT IS CDM? The continuous stream of high profile cybersecurity breaches demonstrates the need to move beyond purely periodic, compliance-based approaches to
Information Technology Policy
Information Technology Policy Security Information and Event Management Policy ITP Number Effective Date ITP-SEC021 October 10, 2006 Category Supersedes Recommended Policy Contact Scheduled Review [email protected]
Network as a Sensor and Enforcer Leverage the Network to Protect Against and Mitigate Threats
Network as a Sensor and Enforcer Leverage the Network to Protect Against and Mitigate Threats Dragan Novaković Consulting Systems Engineer Security November 2015. New Networks Mean New Security Challenges
Using IPsec VPN to provide communication between offices
Using IPsec VPN to provide communication between offices This example provides secure, transparent communication between two FortiGates located at different offices using route-based IPsec VPN. In this
CORE INSIGHT ENTERPRISE: CSO USE CASES FOR ENTERPRISE SECURITY TESTING AND MEASUREMENT
CORE INSIGHT ENTERPRISE: CSO USE CASES FOR ENTERPRISE SECURITY TESTING AND MEASUREMENT How advancements in automated security testing software empower organizations to continuously measure information
Log Analysis: Overall Issues p. 1 Introduction p. 2 IT Budgets and Results: Leveraging OSS Solutions at Little Cost p. 2 Reporting Security
Foreword p. xvii Log Analysis: Overall Issues p. 1 Introduction p. 2 IT Budgets and Results: Leveraging OSS Solutions at Little Cost p. 2 Reporting Security Information to Management p. 5 Example of an
Copyright 2013 Splunk Inc. Introducing Splunk 6
Copyright 2013 Splunk Inc. Introducing Splunk 6 Safe Harbor Statement During the course of this presentation, we may make forward looking statements regarding future events or the expected performance
Fight the Noise with SIEM
Fight the Noise with SIEM An Incident Response System Classified: Public An Indiana Bankers Association Preferred Service Provider! elmdemo.infotex.com Managed Security Services by infotex! Page 2 Incident
End-user Security Analytics Strengthens Protection with ArcSight
Case Study for XY Bank End-user Security Analytics Strengthens Protection with ArcSight INTRODUCTION Detect and respond to advanced persistent threats (APT) in real-time with Nexthink End-user Security
Cisco Cloud Email Security Interoperability with Microsoft Office 365
White Paper Cisco Cloud Email Security Interoperability with Microsoft Office 365 We ve all been witness to the cloud evolution and the technologies that have been driven by moving operations and resources
POLIWALL: AHEAD OF THE FIREWALL
POLIWALL: AHEAD OF THE FIREWALL FIREWALL HISTORY Since the earliest days of the Internet, when hackers sat in their darkened basements dialing into networks with dial-up modems, both network threats and
Eight Essential Elements for Effective Threat Intelligence Management May 2015
INTRODUCTION The most disruptive change to the IT security industry was ignited February 18, 2013 when a breach response company published the first research that pinned responsibility for Advanced Persistent
BUILDING A SECURITY OPERATION CENTER (SOC) ACI-BIT Vancouver, BC. Los Angeles World Airports
BUILDING A SECURITY OPERATION CENTER (SOC) ACI-BIT Vancouver, BC. Los Angeles World Airports Building a Security Operation Center Agenda: Auditing Your Network Environment Selecting Effective Security
Triangle InfoSeCon. Alternative Approaches for Secure Operations in Cyberspace
Triangle InfoSeCon Alternative Approaches for Secure Operations in Cyberspace Lt General Bob Elder, USAF (Retired) Research Professor, George Mason University Strategic Advisor, Georgia Tech Research Institute
Splunk Company Overview
Copyright 2015 Splunk Inc. Splunk Company Overview Name Title Safe Harbor Statement During the course of this presentation, we may make forward looking statements regarding future events or the expected
SITUATIONAL AWARENESS MITIGATE CYBERTHREATS
Gaining the SITUATIONAL AWARENESS needed to MITIGATE CYBERTHREATS Industry Perspective EXECUTIVE SUMMARY To become more resilient against cyberthreats, agencies must improve visibility and understand events
Netzwerkvirtualisierung? Aber mit Sicherheit!
Netzwerkvirtualisierung? Aber mit Sicherheit! Markus Schönberger Advisory Technology Consultant Trend Micro Stephan Bohnengel Sr. Network Virtualization SE VMware Agenda Background and Basic Introduction
POLIWALL: AHEAD OF THE FIREWALL
POLIWALL: AHEAD OF THE FIREWALL FIREWALL HISTORY Since the earliest days of the Internet, when hackers sat in their darkened basements dialing into networks with dial-up modems, both network threats and
Mailwall Remote Features Tour Datasheet
Management Portal & Dashboard Mailwall Remote Features Tour Datasheet Feature Benefit Learn More Screenshot Cloud based portal Securely manage your web filtering policy wherever you are without need for
Protecting the Infrastructure: Symantec Web Gateway
Protecting the Infrastructure: Symantec Web Gateway 1 Why Symantec for Web Security? Flexibility and Choice Best in class hosted service, appliance, and virtual appliance (upcoming) deployment options
Extreme Networks: A SOLUTION WHITE PAPER
Extreme Networks: The Purview Solution Integration with SIEM Integrating Application Management and Business Analytics into other IT management systems A SOLUTION WHITE PAPER WHITE PAPER Introduction Purview
Software that provides secure access to technology, everywhere.
Software that provides secure access to technology, everywhere. Joseph Patrick Schorr @JoeSchorr October, 2015 2015 BOMGAR CORPORATION ALL RIGHTS RESERVED WORLDWIDE 1 Agenda What are we dealing with? How
VISIBLY BETTER RISK AND SECURITY MANAGEMENT
VISIBLY BETTER RISK AND SECURITY MANAGEMENT Mason Hooper Practice Manager, SIEM Solutions, McAfee APAC December 13, 2012 Oct 17 10:00:27, Application=smtp, Oct 17 10:00:27, Application=smtp, Event='Email
The SIEM Evaluator s Guide
Using SIEM for Compliance, Threat Management, & Incident Response Security information and event management (SIEM) tools are designed to collect, store, analyze, and report on log data for threat detection,
Keeping Splunk in Check: Tools to BeGer Manage Your Investment
Copyright 2015 Splunk Inc. Keeping Splunk in Check: Tools to BeGer Manage Your Investment Aaron Kornhauser Sr. Professional Services Consultant, Splunk, Inc. Vladimir Skoryk Sr. Professional Services Consultant,
INCIDENT RESPONSE CHECKLIST
INCIDENT RESPONSE CHECKLIST The purpose of this checklist is to provide clients of Kivu Consulting, Inc. with guidance in the initial stages of an actual or possible data breach. Clients are encouraged
Lumeta IPsonar. Active Network Discovery, Mapping and Leak Detection for Large Distributed, Highly Complex & Sensitive Enterprise Networks
IPsonar provides visibility into every IP asset, host, node, and connection on the network, performing an active probe and mapping everything that's on the network, resulting in a comprehensive view of
Achieving Actionable Situational Awareness... McAfee ESM. Ad Quist, Sales Engineer NEEUR
Achieving Actionable Situational Awareness... McAfee ESM Ad Quist, Sales Engineer NEEUR The Old SECURITY Model Is BROKEN 2 Advanced Targeted Attacks The Reality ADVANCED TARGETED ATTACKS COMPROMISE TO
The Art of Modern Threat Defense. Paul Davis Director, Advanced Threats Security Solution Architects
The Art of Modern Threat Defense Paul Davis Director, Advanced Threats Security Solution Architects January 2016 Goal of Presentation Who Am I A New World of Pain How we are treating the symptoms Silver
Transform E- Commerce the Domino s Pizza Way
Copyright 2014 Splunk Inc. Transform E- Commerce the Domino s Pizza Way Domino s Pizza Russell Turner Disclaimer During the course of this presentafon, we may make forward- looking statements regarding
Hunting for the Undefined Threat: Advanced Analytics & Visualization
SESSION ID: ANF-W04 Hunting for the Undefined Threat: Advanced Analytics & Visualization Joshua Stevens Enterprise Security Architect Hewlett-Packard Cyber Security Technology Office Defining the Hunt
#splunkconf. Analyzing & Mitigating Malicious Web Activity using Splunk Enterprise
#splunkconf Analyzing & Mitigating Malicious Web Activity using Splunk Enterprise StubHub The World s Largest Fan-to-Fan Marketplace At StubHub, our mission is simple: provide fans a safe, convenient place
Firewalls, Tunnels, and Network Intrusion Detection
Firewalls, Tunnels, and Network Intrusion Detection 1 Part 1: Firewall as a Technique to create a virtual security wall separating your organization from the wild west of the public internet 2 1 Firewalls
THE TOP 4 CONTROLS. www.tripwire.com/20criticalcontrols
THE TOP 4 CONTROLS www.tripwire.com/20criticalcontrols THE TOP 20 CRITICAL SECURITY CONTROLS ARE RATED IN SEVERITY BY THE NSA FROM VERY HIGH DOWN TO LOW. IN THIS MINI-GUIDE, WE RE GOING TO LOOK AT THE
How to Leverage Splunk s Security Intelligence PlaKorm for Security OperaNons Environments
Copyright 2013 Splunk Inc. How to Leverage Splunk s Security Intelligence PlaKorm for Security OperaNons Environments Enoch Long Prin Sec Strategist/Client Architect, Splunk(Fed) #splunkconf Legal NoNces
What s Wrong with Information Security Today? You are looking in the wrong places for the wrong things.
What s Wrong with Information Security Today? You are looking in the wrong places for the wrong things. AGENDA Current State of Information Security Data Breach Statics Data Breach Case Studies Why current
Advanced Threat Protection with Dell SecureWorks Security Services
Advanced Threat Protection with Dell SecureWorks Security Services Table of Contents Summary... 2 What are Advanced Threats?... 3 How do advanced threat actors operate?... 3 Addressing the Threat... 5
Defining, building, and making use cases work
Defining, building, and making use cases work Paul Brettle Presales Manager, Americas Pacific Region What is a use case? Compliance FISMA, PCI, SOX, etc Network security firewalls, IDS, routers & switches
Comprehensive Malware Detection with SecurityCenter Continuous View and Nessus. February 3, 2015 (Revision 4)
Comprehensive Malware Detection with SecurityCenter Continuous View and Nessus February 3, 2015 (Revision 4) Table of Contents Overview... 3 Malware, Botnet Detection, and Anti-Virus Auditing... 3 Malware
OPC & Security Agenda
OPC & Security Agenda Cyber Security Today Cyber Security for SCADA/IS OPC Security Overview OPC Security Products Questions & Answers 1 Introduction CYBER SECURITY TODAY The Need for Reliable Information
Chapter 1 The Principles of Auditing 1
Chapter 1 The Principles of Auditing 1 Security Fundamentals: The Five Pillars Assessment Prevention Detection Reaction Recovery Building a Security Program Policy Procedures Standards Security Controls
McAfee Web Gateway Administration Intel Security Education Services Administration Course Training
McAfee Web Gateway Administration Intel Security Education Services Administration Course Training The McAfee Web Gateway Administration course from Education Services provides an in-depth introduction
Unified Security, ATP and more
SYMANTEC Unified Security, ATP and more TAKE THE NEXT STEP Martin Werner PreSales Consultant, Symantec Switzerland AG MEET SWISS INFOSEC! 27.01.2016 Unified Security 2 Symantec Enterprise Security Users
Product Roadmap Symantec Endpoint Protection Suzanne Konvicka & Paul Murgatroyd
Product Roadmap Symantec Endpoint Protection Suzanne Konvicka & Paul Murgatroyd Symantec Endpoint Protection Product Roadmap 1 Safe Harbor Disclaimer Any information regarding pre-release Symantec offerings,
IT Best Practices Audit TCS offers a wide range of IT Best Practices Audit content covering 15 subjects and over 2200 topics, including:
IT Best Practices Audit TCS offers a wide range of IT Best Practices Audit content covering 15 subjects and over 2200 topics, including: 1. IT Cost Containment 84 topics 2. Cloud Computing Readiness 225
Kevin Hayes, CISSP, CISM MULTIPLY SECURITY EFFECTIVENESS WITH SIEM
Kevin Hayes, CISSP, CISM MULTIPLY SECURITY EFFECTIVENESS WITH SIEM TODAY S AGENDA Describe the need for SIEM Explore different options available for SIEM Demonstrate a few Use Cases Cover some caveats
Defence Cyber Protection Partnership Cyber Risks Profile Requirements
Good Governance L.01 Define and assign information security relevant roles and responsibilities. L.02 Define and implement a policy that addresses information security risks within supplier relationships.
Sophistication of attacks will keep improving, especially APT and zero-day exploits
FAQ Isla Q&A General What is Isla? Isla is an innovative, enterprise-class web malware isolation system that prevents all browser-borne malware from penetrating corporate networks and infecting endpoint
E-Guide. Sponsored By:
Security and WAN optimization: Getting the best of both worlds E-Guide As the number of people working outside primary office locations increases, the challenges surrounding security and optimization are
The Protection Mission a constant endeavor
a constant endeavor The IT Protection Mission a constant endeavor As businesses become more and more dependent on IT, IT must face a higher bar for preparedness Cyber preparedness is the process of ensuring
Presentation Title: When Anti-virus Doesn t Cut it: Catching Malware with SIEM
LISA 10 Speaking Proposal Category: Practice and Experience Reports Presentation Title: When Anti-virus Doesn t Cut it: Catching Malware with SIEM Proposed by/speaker: Wyman Stocks Information Security
e2e Secure Cloud Connect Service - Service Definition Document
e2e Secure Cloud Connect Service - Service Definition Document Overview A cloud connectivity service that connects users, devices, offices and clouds together over the Internet. Organisations can choose
Best Practices for PCI DSS V3.0 Network Security Compliance
Best Practices for PCI DSS V3.0 Network Security Compliance January 2015 www.tufin.com Table of Contents Preparing for PCI DSS V3.0 Audit... 3 Protecting Cardholder Data with PCI DSS... 3 Complying with
Larry Wilson Version 1.0 November, 2013. University Cyber-security Program Critical Asset Mapping
Larry Wilson Version 1.0 November, 2013 University Cyber-security Program Critical Asset Mapping Part 3 - Cyber-Security Controls Mapping Cyber-security Controls mapped to Critical Asset Groups CSC Control
Looking at the SANS 20 Critical Security Controls
Looking at the SANS 20 Critical Security Controls Mapping the SANS 20 to NIST 800-53 to ISO 27002 by Brad C. Johnson The SANS 20 Overview SANS has created the 20 Critical Security Controls as a way of
EXPERT STRATEGIES FOR LOG COLLECTION, ROOT CAUSE ANALYSIS, AND COMPLIANCE
EXPERT STRATEGIES FOR LOG COLLECTION, ROOT CAUSE ANALYSIS, AND COMPLIANCE A reliable, high-performance network is critical to your IT infrastructure and organization. Equally important to network performance
Caretower s SIEM Managed Security Services
Caretower s SIEM Managed Security Services Enterprise Security Manager MSS -TRUE 24/7 Service I.T. Security Specialists Caretower s SIEM Managed Security Services 1 Challenges & Solution Challenges During
Addressing the SANS Top 20 Critical Security Controls for Effective Cyber Defense
A Trend Micro Whitepaper I February 2016 Addressing the SANS Top 20 Critical Security Controls for Effective Cyber Defense How Trend Micro Deep Security Can Help: A Mapping to the SANS Top 20 Critical
Compliance Overview: FISMA / NIST SP800 53
Compliance Overview: FISMA / NIST SP800 53 FISMA / NIST SP800 53: Compliance Overview With Huntsman SIEM The US Federal Information Security Management Act (FISMA) is now a key element of the US Government
REVOLUTIONIZING ADVANCED THREAT PROTECTION
REVOLUTIONIZING ADVANCED THREAT PROTECTION A NEW, MODERN APPROACH Blue Coat Advanced Threat Protection Group GRANT ASPLUND Senior Technology Evangelist 1 WHY DO I STAND ON MY DESK? "...I stand upon my
Splunk Enterprise in the Cloud Vision and Roadmap
Copyright 2013 Splunk Inc. Splunk Enterprise in the Cloud Vision and Roadmap Alex Munk PM Cloud #splunkconf Ledio Ago Director of Engineering Cloud Legal NoJces During the course of this presentajon, we
National Railroad Passenger Corp. (AMTRAK) Session 1 Threats and Constraints. Continuous. - Continuous Monitoring. - Continuous Assessment
0 National Railroad Passenger Corp. (AMTRAK) Session 1 Threats and Constraints Continuous - Continuous Monitoring - Continuous Assessment - Continuous Education 1 Amtrak Information Security Challenges
U06 IT Infrastructure Policy
Dartmoor National Park Authority U06 IT Infrastructure Policy June 2010 This document is copyright to Dartmoor National Park Authority and should not be used or adapted for any purpose without the agreement
Firewalls, Tunnels, and Network Intrusion Detection. Firewalls
Firewalls, Tunnels, and Network Intrusion Detection 1 Firewalls A firewall is an integrated collection of security measures designed to prevent unauthorized electronic access to a networked computer system.