Best Practices in File Integrity Monitoring. Ed Jowett, CISSP ITIL Practitioner Sr. Systems Engineer, Tripwire Inc.

Size: px

Start display at page:

Download "Best Practices in File Integrity Monitoring. Ed Jowett, CISSP ITIL Practitioner Sr. Systems Engineer, Tripwire Inc."

Joy Foster
8 years ago
Views:

1 Best Practices in File Integrity Monitoring Ed Jowett, CISSP ITIL Practitioner Sr. Systems Engineer, Tripwire Inc.

2 Who is Ed Jowett 2

3 Agenda Best Practices in FIM The 3 Main Drivers of FIM Lessons Learned Integration Points SEM, SCM, CMS, VA, etc Best Practice Techniques Alerts / Reports Depth and Frequency General Discussion 3

4 The main drivers of FIM Three (3) main drivers that I see Compliance / Regulations Security / Risk Programs Operational Requirements What s drives FIM at your company? 4

5 PCI Compliance and Beyond Have you reviewed the PCI DSS? 5

6 Why File Integrity Monitoring? What do I have? What did it used to look like? What should it look like? How has it changed? Why should I care? Who needs to know?

7 7

8 The Physical vs. The Virtual What/Who do we need to monitor? System Admin or Virtual Admin What/Who can do more harm? 8

9 Security Programs need a Sandbox How often do you run a test? 9

10 Integration Points What other systems can use this type of data? Change Mgmt. System Security Config. Mgmt. Security Event Mgmt. Log Mgmt. Vulnerability Mgmt. and others. Do your organization maintain some sort of hardening guides? 10

Log Mgmt. Vulnerability Mgmt. and others.

11 11

12 Crawl Walk Run 12

13 Gain Situational Awareness Knowledge is Power Server Classification Documentation Determine Business Ownership and Risk Asset Location Physical Characteristics Node Classification is easy to implement High Severity means Mandatory Response Addition vs Removal of an object

Physical Characteristics Node Classification is easy to implement

14 Classification Techniques Needs alignment to the business Custom Properties / Tags Change Characteristics Severity and Risk Values System Classification is Critical Service Group vs. Business Group Re-Assessment is required

Characteristics Severity and Risk Values System

15 Automate the Response with Reports and Alerts " Reduce massive volume of data Correlate (bad) changes and other (suspicious) events " Distill intelligent information " Respond immediately Get the details to the right folks Make risk-based decision How do you gather feedback from the report users?

intelligent information " Respond immediately Get the details to the right

16 When The Inevitable Happens

17 Forensics Are Key To Understanding the Breach " If a hacker breaks into your infrastructure you need to not only understand the current state of the infrastructure but what it looked like five minutes before the breach " PCI Section 10.6 and 11.5 are written specifically to understand the breadth and depth of the breach " Good forensic information will dramatically reduce the cost of clean up and answer three critical questions you will be asked What happened? How badly was I exposed? How can I stop it from happening again? " Maintaining an accurate Baseline is KEY!

5 are written specifically to understand the breadth and depth of the breach " Good forensic information will dramatically reduce the cost of

18 Depth of Monitoring 18

19 Frequency Matters to insure a Known, Good State KNOWN AND TRUSTED STATE CHANGE Confidence Time MEGASCAN required to reassess Continuous Monitoring Lowers MTTR Increases Security Reduces Risks Sustainable MANUAL ASSESSMENT TRADITIONAL ASSESSMENT CONTINUOUS ASSESSMENT

Continuous Monitoring Lowers MTTR Increases Security Reduces Risks

20 In Summary - Why File Integrity Monitoring? What do I have? Gain Situational Awareness What did it used to look like? Maintain an accurate Baseline What should it look like? - Enforce your hardening guidelines How has it changed? - Attributes, Content or HASH Why should I care? Node Classification Who needs to know? Proper and Accurate Reports and Alerts

Maintain an accurate Baseline What should it look like?

21 Questions and General Discussion Ed Jowett Tripwire Americas: TRIPWIRE Tripwire EMEA: +44 (0) Tripwire Japan: Tripwire Singapore: Tripwire Australia-New Zealand: +61 (0)

22 Integrated & Automated Security Intelligence VISIBILITY INTELLIGENCE AUTOMATION Iden%fy events of interest Correlate to Bad Changes SIEM Log Management Remediation Engine Policy Engine Continuous Monitoring Iden%fy changes of interest Correlate to Suspicious Events Correlate to Security Policy Iden%fy threats of interest 22

TRIPWIRE NERC SOLUTION SUITE

CONFIDENCE: SECURED SOLUTION BRIEF TRIPWIRE NERC SOLUTION SUITE TAILORED SUITE OF PRODUCTS AND SERVICES TO AUTOMATE NERC CIP COMPLIANCE u u We ve been able to stay focused on our mission of delivering