Metrics Suite for Enterprise-Level Attack Graph Analysis
|
|
|
- Ralph Randall
- 8 years ago
- Views:
Transcription
1 Metrics Suite for Enterprise-Level Attack Graph Analysis Cyber Security Division 2012 Principal Investigators Meeting October 11, 2012 Sushil Jajodia (PI), Steven Noel (co-pi) Metrics Suite for Enterprise-Level Attack Graph Analysis Center for Secure Information Systems, George Mason University [jajodia,
2 Introduction TTA #2 (Enterprise-Level Security Metrics), Type III GMU Center for Secure Information Systems Top national research and academic security center 10+ years developing TVA technology 20+ TVA-related publications, 700+ citations 5 TVA-related patents, others pending Applied Visions, Inc. Experts in data visualization Interactive visualizations of attack graph metrics ProInfo, Inc. Lead commercialization efforts in Cauldron Strategic vision for Cauldron rollout Support customer engagements 2
3 Project Goals Suite of metrics for measuring enterprise cyber security risk Based on multi-step attack vulnerability throughout the network Complementary metrics for measuring different aspects of enterprise security Based on applicable standards (CVE, CVSS, etc.) Interactive visualizations showing how security evolves over time Integration with Cauldron attack graph tool 3
4 System Architecture Vulnerability Scanning Penetration Testing Data loss intelligence Port scanning Firewalls And Routers Asset management Vulnerability data Integration Points Nessus Retina Foundstone ncircle Core Impact Unveillance nmap Cisco Juniper Sidewinder Discovery BDNA NIST NVD Network Modeler Enterprise Metrics Suite Metrics Engine Metrics Visualizer Attack Graph Analysis 4
5 Motivating Example Remediate By Host (Top 3) No remediation Remediate By Connection (Top 3) Remediate By CVSS (Top 15) 5
6 Challenges Understand impact of combined vulnerabilities and policies on security posture Prioritize critical problems Compare options for risk mitigation Measure improvement or degradation of security over time Build comprehensive and accurate models of networks, vulnerabilities, and risk factors Apply meaningful metrics that inform decisions in complex environments 6
7 Metrics Capabilities Isolated network data and events Hosts, vulnerabilities, firewall rules, IDS events, etc. without context Attack graph elements Isolated data correlated and placed in context of layered defenses Attack graph logic and structure Impact of threats throughout network, how likely an attack will succeed Attack graph predictive analysis What-if scenarios, zero-day vulnerabilities 7
8 Sample Metrics Vulnerability-Exploitability-Attackability Measures host vulnerability, exploitation likelihood, and ratio of actual to potential number of attack paths Attack graphs as collections of single-step attacks Attack Likelihood How likely an attack scenario will succeed Overall attack risk based on attack graph logical relationships CVSS Interdependency Analyzes interdependencies of CVSS base metrics for vulnerabilities In context of attack path sequences k-zero-day Safety Ability of network to survive exploitation of zero-day vulnerabilities Favors layered attack defenses and heterogeneous platforms 8
9 Small Example Firewall Policy Allow ftp(0,1), rsh(0,1), ssh(0,1), ftp(0,2), rsh(0,2) Deny all other sshd_bof(0,1) rsh_rhosts(0,1) Or rsh_rhosts(1,2) rsh_rhosts(0,2) Or local_bof(2) Attack Goal 9
10 Options to Compare Option 1: block ssh(0,1) and rsh(0,2) in firewall Option 2: block rsh(0,1) and rsh(0,2) in firewall rsh_rhosts(0,1) sshd_bof(0,1) rsh_rhosts(1,2) rsh_rhosts(1,2) local_bof(2) Attack Goal local_bof(2) Attack Goal Option 3: Patch vulnerabilities, no change to firewall Option 4: Patch vulnerabilities, change firewall per Option 1 Option 5: Patch vulnerabilities, change firewall per Option 2 10
11 Comparison Results Network Attack CVSS k Zero VEA Configuration Likelihood Interdependency Day Initial Option Option Option 3 (Initial patched) Option 4 (Option 1 patched) Option 5 (Option 2 patched) Initial / Option
12 Metrics Visualization 12
13 Visually Comparing Options Initial Option 1 Option 2 Option 3 Option 4 Option 5 13
14 Cauldron Dashboard 14
15 Schedule and Deliverables Project Reviews (kickoff, mid-year, end of year), interim meetings via video/telephone/web Software implementation and associated documentation Monthly status reports Final Report (requirements, design, interfaces, test results, lessons learned, etc.) 15
16 Transition Plan Cauldron commercialization through Mason Tech Transfer (GMIP) and ProInfo/CyVision partnership Cauldron deployed in a variety of customer settings Significant IP, protected by patents and copyrights Available under GSA scheduling Marketing through direct sales and a network of resellers, strategic partners, and OEM relationships Strategic partners for services and complementary technologies Strategy: Identify early adopters for new metrics capabilities combined with Cauldron, delivering mission-critical requirements for situational awareness, common operating picture, and visualization 16
17 Metrics Suite for Enterprise-Level Attack Graph Analysis Vulnerability Scanning Penetration Testing Data loss intelligence Port scanning Firewalls And Routers Asset management Vulnerability data Potential Integration Points Nessus Retina Foundstone ncircle Core Impact Unveillance nmap Cisco Juniper Sidewinder Discovery BDNA NIST NVD Network Modeler Enterprise Metrics Suite Metrics Engine Metrics Visualizer Attack Graph Analysis OPERATIONAL CAPABILITY Suite of metrics for enterprise network security risks. Based on network-wide model of multi-step attack vulnerability. Complementary metrics for measuring different aspects of enterprise security. Integrates seamlessly with Cauldron attack graph tool. TECHNICAL APPROACH Model network attack vulnerability, populate from scan tools, firewalls, and other data sources. Correlate model with known cyber attack vulnerabilities and environmental metadata, apply network access policy rules. Based on assumed threat sources and missioncritical assets, compute network-wide metrics that measure security for the entire enterprise. Visualize for trending and comparative analysis. SCHEDULE & CONTACT INFO. Principal Investigator: Sushil Jajodia Center for Secure Information Systems George Mason University Subcontractors: Applied Visions, Inc. (Secure Decisions Division) ProInfo, Inc. 17
Network Security and Risk Analysis Using Attack Graphs
Network Security and Risk Analysis Using Attack Graphs Anoop Singhal National Institute of Standards and Technology Coauthors: Lingyu Wang and Sushil Jajodia Concordia University George Mason University
Proactive Intrusion Prevention and Response via Attack Graphs
Proactive Intrusion Prevention and Response via Attack Graphs Steven Noel and Sushil Jajodia Center for Secure Information Systems, George Mason University {snoel, jajodia}@gmu.edu Network defense today
WHITE PAPER AUTOMATED, REAL-TIME RISK ANALYSIS AND REMEDIATION
WHITE PAPER AUTOMATED, REAL-TIME RISK ANALYSIS AND REMEDIATION Table of Contents Executive Summary...3 Vulnerability Scanners Alone Are Not Enough...3 Real-Time Change Configuration Notification is the
How To Analyze And Detect A Network Attack Through A Network Graph
Advanced Vulnerability Analysis and Intrusion Detection Through Predictive Attack Graphs Steven Noel and Sushil Jajodia Center for Secure Information Systems, George Mason University, Fairfax, VA, USA
NERC CIP VERSION 5 COMPLIANCE
BACKGROUND The North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) Reliability Standards define a comprehensive set of requirements that are the basis for maintaining
CONTINUOUS DIAGNOSTICS BEGINS WITH REDSEAL
CONTINUOUS DIAGNOSTICS BEGINS WITH REDSEAL WHAT IS CDM? The continuous stream of high profile cybersecurity breaches demonstrates the need to move beyond purely periodic, compliance-based approaches to
Advances in Topological Vulnerability Analysis
Advances in Topological Vulnerability Analysis Steven Noel 1, Matthew Elder 2, Sushil Jajodia 1, Pramod Kalapa 1, Scott O Hare 3, Kenneth Prole 3 1 Center for Secure Information Systems, George Mason University,
VEA-bility Security Metric: A Network Security Analysis Tool
VEA-bility Security Metric: A Network Security Analysis Tool Melanie Tupper Dalhousie University tupper@cs.dal.ca A. Nur Zincir-Heywood Dalhousie University zincir@cs.dal.ca Abstract In this work, we propose
Attack Graph Techniques
Chapter 2 Attack Graph Techniques 2.1 An example scenario Modern attack-graph techniques can automatically discover all possible ways an attacker can compromise an enterprise network by analyzing configuration
NIST Interagency Report 7788 Security Risk Analysis of Enterprise Networks Using Probabilistic Attack Graphs
NIST Interagency Report 7788 Security Risk Analysis of Enterprise Networks Using Probabilistic Attack Graphs Anoop Singhal Ximming Ou NIST Interagency Report 7788 Security Risk Analysis of Enterprise Networks
A Review on Zero Day Attack Safety Using Different Scenarios
Available online www.ejaet.com European Journal of Advances in Engineering and Technology, 2015, 2(1): 30-34 Review Article ISSN: 2394-658X A Review on Zero Day Attack Safety Using Different Scenarios
Best Practices for Vulnerability Management
4 Steps to Reducing Risk with Vulnerability Management Best Practices Is Your Vulnerability Management Process Meaningful To Your Business? The vulnerability management process can be very useful and provide
Obtaining Enterprise Cybersituational
SESSION ID: SPO-R06A Obtaining Enterprise Cybersituational Awareness Eric J. Eifert Sr. Vice President Managed Security Services DarkMatter Agenda My Background Key components of the Cyber Situational
1 Scope of Assessment
CIT 380 Project Network Security Assessment Due: April 30, 2014 This project is a security assessment of a small group of systems. In this assessment, students will apply security tools and resources learned
ADDING NETWORK INTELLIGENCE TO VULNERABILITY MANAGEMENT
ADDING NETWORK INTELLIGENCE INTRODUCTION Vulnerability management is crucial to network security. Not only are known vulnerabilities propagating dramatically, but so is their severity and complexity. Organizations
PROJECT BOEING SGS. Interim Technology Performance Report 3. Company Name: The Boeing Company. Contract ID: DE-OE0000191
Interim Techlogy Performance Report 3 PROJECT BOEING SGS Contract ID: DE-OE0000191 Project Type: Revision: V1 Company Name: The Boeing Company November 19, 2013 1 Interim Techlogy Performance Report 3
Cyber Security RFP Template
About this document This RFP template was created to help IT security personnel make an informed decision when choosing a cyber security solution. In this template you will find categories for initial
Proactive Security through Effective Management
Proactive Security through Effective Management COMPANY Overview There are fundamental flaws in the way enterprises manage their network security infrastructures. We created FireMon, an enterprise security
Quantitative Security Risk Analysis of Enterprise Systems: Techniques and Challenges Tutorial ICISS, December 2014
Quantitative Security Risk Analysis of Enterprise Systems: Techniques and Challenges Tutorial ICISS, December 2014 Anoop Singhal Computer Security Division National Institute of Standards and Technology
WHITE PAPER ON SECURITY TESTING IN TELECOM NETWORK
WHITE PAPER ON SECURITY TESTING IN TELECOM NETWORK DATE OF RELEASE: 27 th July 2012 Table of Contents 1. Introduction... 2 2. Need for securing Telecom Networks... 3 3. Security Assessment Techniques...
Topological Vulnerability Analysis
Topological Vulnerability Analysis Sushil Jajodia and Steven Noel Traditionally, network administrators rely on labor-intensive processes for tracking network configurations and vulnerabilities. This requires
ESKISP6055.01 Manage security testing
Overview This standard covers the competencies concerning with managing security testing activities. Including managing resources activities and deliverables. This includes planning, conducting and reporting
IBM Security QRadar SIEM & Fortinet FortiGate / FortiAnalyzer
IBM Security QRadar SIEM & Fortinet / FortiAnalyzer Introducing new functionality for IBM QRadar Security Intelligence Platform: integration with Fortinet s firewalls and logs forwarded by FortiAnalyzer.
IBM Security QRadar Risk Manager
IBM Security QRadar Risk Manager Proactively manage vulnerabilities and network device configuration to reduce risk, improve compliance Highlights Collect network security device configuration data to
A Biologically Inspired Approach to Network Vulnerability Identification
A Biologically Inspired Approach to Network Vulnerability Identification Evolving CNO Strategies for CND Todd Hughes, Aron Rubin, Andrew Cortese,, Harris Zebrowitz Senior Member, Engineering Staff Advanced
PUTTING NIST GUIDELINES FOR INFORMATION SECURITY CONTINUOUS MONITORING INTO PRACTICE
PUTTING NIST GUIDELINES FOR INFORMATION SECURITY CONTINUOUS MONITORING INTO PRACTICE Since Congress instituted the Federal Information Security Management Act (FISMA) of 2002 to address the rapid proliferation
Session 9: Changing Paradigms and Challenges Tools for Space Systems Cyber Situational Awareness
Session 9: Changing Paradigms and Challenges Tools for Space Systems Cyber Situational Awareness Wayne A. Wheeler The Aerospace Corporation GSAW 2015, Los Angeles, CA, March 2015 Agenda Emerging cyber
White Paper. Time for Integrated vs. Bolted-on IT Security. Cyphort Platform Architecture: Modular, Open and Flexible
White Paper Time for Integrated vs. Bolted-on IT Security Cyphort Platform Architecture: Modular, Open and Flexible Overview This paper discusses prevalent market approaches to designing and architecting
TECHNOLOGY INTEGRATION GUIDE
TECHNOLOGY INTEGRATION GUIDE INTRODUCTION RedSeal s cybersecurity analytics platform integrates data from your network devices and security solutions to provide a comprehensive model of your network and
How To Create An Intelligent Infrastructure Solution
SYSTIMAX Solutions Intelligent Infrastructure & Security Using an Internet Protocol Architecture for Security Applications White Paper July 2009 www.commscope.com Contents I. Intelligent Building Infrastructure
White Paper. Managing Risk to Sensitive Data with SecureSphere
Managing Risk to Sensitive Data with SecureSphere White Paper Sensitive information is typically scattered across heterogeneous systems throughout various physical locations around the globe. The rate
Vulnerability Management
Vulnerability Management Buyer s Guide Buyer s Guide 01 Introduction 02 Key Components 03 Other Considerations About Rapid7 01 INTRODUCTION Exploiting weaknesses in browsers, operating systems and other
Sample Vulnerability Management Policy
Sample Internal Procedures and Policy Guidelines February 2015 Document Control Title: Document Control Number: 1.0.0 Initial Release: Last Updated: February 2015, Manager IT Security February 2015, Director
IBM Security QRadar Risk Manager
IBM Security QRadar Risk Manager Proactively manage vulnerabilities and network device configuration to reduce risk, improve compliance Highlights Visualize current and potential network traffic patterns
A Framework for Analysis A Network Vulnerability
A Framework for Analysis A Tito Waluyo Purboyo 1, Kuspriyanto 2 1,2 School of Electrical Engineering & Informatics, Institut Teknologi Bandung Jl. Ganesha 10 Bandung 40132, Indonesia Abstract: administrators
Cisco Advanced Services for Network Security
Data Sheet Cisco Advanced Services for Network Security IP Communications networking the convergence of data, voice, and video onto a single network offers opportunities for reducing communication costs
Risk Analytics for Cyber Security
Risk Analytics for Cyber Security Justin Coker, VP EMEA, Skybox Security IT Challenges 2015, Belgium 2nd October 2014 www.skyboxsecurity.com justin.coker@skyboxsecurity.com +44 (0) 7831 691498 Risk Analytics
Business white paper. Missioncritical. defense. Creating a coordinated response to application security attacks
Business white paper Missioncritical defense Creating a coordinated response to application security attacks Table of contents 3 Your business is under persistent attack 4 Respond to those attacks seamlessly
Extreme Networks Security Analytics G2 Risk Manager
DATA SHEET Extreme Networks Security Analytics G2 Risk Manager Proactively manage vulnerabilities and network device configuration to reduce risk, improve compliance HIGHLIGHTS Visualize current and potential
The Cyber OODA Loop: How Your Attacker Should Help You Design Your Defense. Tony Sager The Center for Internet Security
The Cyber OODA Loop: How Your Attacker Should Help You Design Your Defense Tony Sager The Center for Internet Security Classic Risk Equation Risk = { Vulnerability, Threat, Consequence } countermeasures
ECS 235A Project - NVD Visualization Using TreeMaps
ECS 235A Project - NVD Visualization Using TreeMaps Kevin Griffin Email: kevgriffin@ucdavis.edu December 12, 2013 1 Introduction The National Vulnerability Database (NVD) is a continuously updated United
SANS Top 20 Critical Controls for Effective Cyber Defense
WHITEPAPER SANS Top 20 Critical Controls for Cyber Defense SANS Top 20 Critical Controls for Effective Cyber Defense JANUARY 2014 SANS Top 20 Critical Controls for Effective Cyber Defense Summary In a
7 Homeland. ty Grant Program HOMELAND SECURITY GRANT PROGRAM. Fiscal Year 2008
U.S. D EPARTMENT OF H OMELAND S ECURITY 7 Homeland Fiscal Year 2008 HOMELAND SECURITY GRANT PROGRAM ty Grant Program SUPPLEMENTAL RESOURCE: CYBER SECURITY GUIDANCE uidelines and Application Kit (October
Cisco Security IntelliShield Alert Manager Service
Data Sheet Cisco Security IntelliShield Alert Manager Service The Cisco Security IntelliShield Alert Manager Service provides a comprehensive, cost-effective solution for delivering the security intelligence
Asset Discovery with Symantec Control Compliance Suite
WHITE PAPER: ASSET DISCOVERY WITH SYMANTEC CONTROL COMPLIANCE............. SUITE........................... Asset Discovery with Symantec Control Compliance Suite Who should read this paper IT Operations
Intro to QualysGuard IT Risk & Asset Management. Marek Skalicky, CISM, CRISC Regional Account Manager for Central & Adriatic Eastern Europe
Intro to QualysGuard IT Risk & Asset Management Marek Skalicky, CISM, CRISC Regional Account Manager for Central & Adriatic Eastern Europe A Unified and Continuous View of ICT Security, Risks and Compliance
INTEGRATION GUIDE TECHNOLOGY INTRODUCTION NETWORK DEVICES AND INFRASTRUCTURE
TECHNOLOGY INTEGRATION GUIDE INTRODUCTION RedSeal s cybersecurity analytics platform integrates data from your network devices and security solutions to provide a comprehensive model of your network and
Overview Commitment to Energy and Utilities Robert Held Sr. Systems Engineer Strategic Energy August 2015
Overview Commitment to Energy and Utilities Robert Held Sr. Systems Engineer Strategic Energy August 2015 Tripwire Evolution 18+ Years of Innovation 1997 Tripwire File System Monitoring from open source
Optimizing Network Vulnerability
SOLUTION BRIEF Adding Real-World Exposure Awareness to Vulnerability and Risk Management Optimizing Network Vulnerability Management Using RedSeal november 2011 WHITE PAPER RedSeal Networks, Inc. 3965
Penetration Testing Report Client: Business Solutions June 15 th 2015
Penetration Testing Report Client: Business Solutions June 15 th 2015 Acumen Innovations 80 S.W 8 th St Suite 2000 Miami, FL 33130 United States of America Tel: 1-888-995-7803 Email: info@acumen-innovations.com
Appalachian Regional Commission Evaluation Report. Table of Contents. Results of Evaluation... 1. Areas for Improvement... 2
Report No. 13-35 September 27, 2013 Appalachian Regional Commission Table of Contents Results of Evaluation... 1 Areas for Improvement... 2 Area for Improvement 1: The agency should implement ongoing scanning
Intelligent Vulnerability Management The Art of Prioritizing Remediation. Phone Conference
Intelligent Vulnerability Management The Art of Prioritizing Remediation An IANS Interactive Phone Conference SUMMARY OF FINDINGS F e b r u a ry 2010 Context Joel Scambray shared IANS point of view on
CORE INSIGHT ENTERPRISE: CSO USE CASES FOR ENTERPRISE SECURITY TESTING AND MEASUREMENT
CORE INSIGHT ENTERPRISE: CSO USE CASES FOR ENTERPRISE SECURITY TESTING AND MEASUREMENT How advancements in automated security testing software empower organizations to continuously measure information
How To Monitor Your Entire It Environment
Preparing for FISMA 2.0 and Continuous Monitoring Requirements Symantec's Continuous Monitoring Solution White Paper: Preparing for FISMA 2.0 and Continuous Monitoring Requirements Contents Introduction............................................................................................
YOUR NETWORK SECURITY WITH PROACTIVE SECURITY INTELLIGENCE
FAST FORWARD YOUR NETWORK SECURITY WITH PROACTIVE SECURITY INTELLIGENCE VISUALIZE COMPLY PROTECT RedSeal Networks, Inc. 3965 Freedom Circle, 8th Floor, Santa Clara, 95054 Tel (408) 641-2200 Toll Free (888)
TECHNOLOGY INTEGRATION GUIDE
TECHNOLOGY INTEGRATION GUIDE INTRODUCTION RedSeal s cybersecurity analytics platform integrates data from your network devices and security solutions to provide a comprehensive model of your network and
Virtual Terrain: A Security-Based Representation of a Computer Network
Virtual Terrain: A Security-Based Representation of a Computer Network Jared Holsopple* a, Shanchieh Yang b, Brian Argauer b a CUBRC, 4455 Genesee St, Buffalo, NY, USA 14225; b Dept. of Computer Engineering,
User s Guide. Skybox Risk Control 7.0.0. Revision: 11
User s Guide Skybox Risk Control 7.0.0 Revision: 11 Copyright 2002-2014 Skybox Security, Inc. All rights reserved. This documentation contains proprietary information belonging to Skybox Security and is
Continuous Network Monitoring
Continuous Network Monitoring Eliminate periodic assessment processes that expose security and compliance programs to failure Continuous Network Monitoring Continuous network monitoring and assessment
REDSEAL NETWORKS SOLUTION BRIEF. Proactive Network Intelligence Solutions For PCI DSS Compliance
REDSEAL NETWORKS SOLUTION BRIEF Proactive Network Intelligence Solutions For PCI DSS Compliance Overview PCI DSS has become a global requirement for all entities handling cardholder data. A company processing,
VULNERABILITY MANAGEMENT
Vulnerability Management (VM) software differ in the richness of reporting, and the capabilities for application and security configuration assessment. Companies must consider how a VM technology will
SECURITY CONTROLS AND RISK MANAGEMENT FRAMEWORK
SECURITY CONTROLS AND RISK MANAGEMENT FRAMEWORK BACKGROUND The National Institute of Standards and Technology (NIST) Special Publication 800-53 defines a comprehensive set of controls that is the basis
IBM Security. 2013 IBM Corporation. 2013 IBM Corporation
IBM Security Security Intelligence What is Security Intelligence? Security Intelligence --noun 1.the real-time collection, normalization and analytics of the data generated by users, applications and infrastructure
PASTA Abstract. Process for Attack S imulation & Threat Assessment Abstract. VerSprite, LLC Copyright 2013
2013 PASTA Abstract Process for Attack S imulation & Threat Assessment Abstract VerSprite, LLC Copyright 2013 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Attack Intelligence: Why It Matters
Attack Intelligence: Why It Matters WHITE PAPER Core Security +1 617.399-6980 info@coresecurity.com www.coresecurity.com A Proactive Strategy Attacks against your organization are more prevalent than ever,
Vulnerability Risk Management 2.0. Best Practices for Managing Risk in the New Digital War
Vulnerability Risk Management 2.0 Best Practices for Managing Risk in the New Digital War In 2015, 17 new security vulnerabilities are identified every day. One nearly every 90 minutes. This consistent
NETWORK PENETRATION TESTS FOR EHR MANAGEMENT SOLUTIONS PROVIDER
A C a s e s t u d y o n h o w Z e n Q h a s h e l p e d a L e a d i n g K - 1 2 E d u c a t i o n & L e a r n i n g S o l u t i o n s P r o v i d e r i n U S g a u g e c a p a c i t y o f t h e i r f l
Cautela Labs Cloud Agile. Secured. Threat Management Security Solutions at Work
Cautela Labs Cloud Agile. Secured. Threat Management Security Solutions at Work Security concerns and dangers come both from internal means as well as external. In order to enhance your security posture
NYS LOCAL GOVERNMENT VULNERABILITY SCANNING PROJECT September 22, 2011
NYS LOCAL GOVERNMENT VULNERABILITY SCANNING PROJECT September 22, 2011 Executive Summary BACKGROUND The NYS Local Government Vulnerability Scanning Project was funded by a U.S. Department of Homeland Security
Our Vulnerability Scanning Program
Our Vulnerability Scanning Program INTERACTIVE CODE SCANNING KRI s z/os Interactive Code Scanning strengthens an organizations enterprise security by: Providing Interactive Application Security Testing
Secure Content Automation Protocol (SCAP): How it is increasingly used to automate enterprise security management activities
Secure Content Automation Protocol (SCAP): How it is increasingly used to automate enterprise security management activities Sean Barnum sbarnum@mitre.org September 2011 Overview What is SCAP? Why SCAP?
Running head: USING NESSUS AND NMAP TOOLS 1
Running head: USING NESSUS AND NMAP TOOLS 1 Nessus and Nmap Overview - Scanning Networks Research Paper On Nessus and Nmap Mike Pergande Ethical Hacking North Iowa Area Community College Running head:
Metrics that Matter Security Risk Analytics
Metrics that Matter Security Risk Analytics Rich Skinner, CISSP Director Security Risk Analytics & Big Data Brinqa rskinner@brinqa.com April 1 st, 2014. Agenda Challenges in Enterprise Security, Risk
Technology Blueprint. Protect Your Email Servers. Guard the data and availability that enable business-critical communications
Technology Blueprint Protect Your Email Servers Guard the data and availability that enable business-critical communications LEVEL 1 2 3 4 5 SECURITY CONNECTED REFERENCE ARCHITECTURE LEVEL 1 2 4 5 3 Security
Information Security Office
Information Security Office SAMPLE Risk Assessment and Compliance Report Restricted Information (RI). Submitted to: SAMPLE CISO CIO CTO Submitted: SAMPLE DATE Prepared by: SAMPLE Appendices attached: Appendix
Optimal IDS Sensor Placement And Alert Prioritization Using Attack Graphs
Optimal IDS Sensor Placement And Alert Prioritization Using Attack Graphs Steven Noel and Sushil Jajodia Center for Secure Information Systems George Mason University, Fairfax, Virginia Abstract We optimally
Pragmatic Metrics for Building Security Dashboards
SESSION ID: GRC-W03 Pragmatic Metrics for Building Security Dashboards James Tarala Principal Consultant Enclave Security @isaudit Problem Statement What s measured improves. Peter Drucker In an era of
Prevent cyber attacks. SEE. what you are missing. Netw rk Infrastructure Security Management
Prevent cyber attacks. SEE what you are missing. See Your Network MAP. Prevent Cyber Attacks. Driven by the need to support evolving business objectives, enterprise IT infrastructures have grown increasingly
Total Protection for Compliance: Unified IT Policy Auditing
Total Protection for Compliance: Unified IT Policy Auditing McAfee Total Protection for Compliance Regulations and standards are growing in number, and IT audits are increasing in complexity and cost.
IBM Managed Security Services Vulnerability Scanning:
IBM Managed Security Services August 2005 IBM Managed Security Services Vulnerability Scanning: Understanding the methodology and risks Jerry Neely Network Security Analyst, IBM Global Services Page 2
Prevent cyber attacks. SEE. what you are missing. Netw rk Infrastructure Security Management
Prevent cyber attacks. SEE what you are missing. See Your Network MAPS. Prevent cyber attacks. [RedSeal] is meeting our expectations and is playing an integral role as it feeds right into our overall risk
Addressing FISMA Assessment Requirements
SOLUTION BRIEF Heeding FISMA s Call for Security Metrics and Continuous Network Monitoring Addressing FISMA Assessment Requirements Using RedSeal november 2011 WHITE PAPER RedSeal Networks, Inc. 3965 Freedom
Executive Summary Primer iv
Executive Summary Primer iv Primer Contents CONTENTS EXECUTIVE SUMMARY...iii 1. INTRODUCTION... 1 2. CONTROL SYSTEMS CYBER SECURITY FRAMEWORK... 2 2.1 Security Group Knowledge... 3 2.2 Attack Group Knowledge...
SourceFireNext-Generation IPS
D Ů V Ě Ř U J T E S I L N Ý M SourceFireNext-Generation IPS Petr Salač CCNP Security, CCNP, CICSP, CCSI #33835 petr.salac@alefnula.com Our Customers Biggest Security Challenges Maintaining security posture
CHAPTER 3 : INCIDENT RESPONSE FIVE KEY RECOMMENDATIONS GLOBAL THREAT INTELLIGENCE REPORT 2015 :: COPYRIGHT 2015 NTT INNOVATION INSTITUTE 1 LLC
: INCIDENT RESPONSE FIVE KEY RECOMMENDATIONS 1 FIVE KEY RECOMMENDATIONS During 2014, NTT Group supported response efforts for a variety of incidents. Review of these engagements revealed some observations
QRadar SIEM 6.3 Datasheet
QRadar SIEM 6.3 Datasheet Overview Q1 Labs flagship solution QRadar SIEM is unrivaled in its ability to provide an organization centralized IT security command and control. The unique capabilities of QRadar
How To Manage Sourcefire From A Command Console
Sourcefire TM Sourcefire Capabilities Store up to 100,000,000 security & host events, including packet data Centralized policy & sensor management Centralized audit logging of configuration & security
Getting Started with the iscan Online Data Breach Risk Intelligence Platform
Getting Started with the iscan Online Data Breach Risk Intelligence Platform 2 Table of Contents Overview... 3 Data Breach Risk Intelligence... 3 Data Breach Prevention Lifecycle Defined... 3 Choosing
Measuring Security Risk of Networks Using Attack Graphs
Measuring Security Risk of Networks Using Attack Graphs STEVEN NOEL, SUSHIL JAJODIA Center for Secure Information Systems, George Mason University, Fairfax, Virginia, USA LINGYU WANG Concordia University,
VEA-bility Analysis of Network Diversification
VEA-bility Analysis of Network Diversification Melanie Tupper Supervised by Nur Zincir-Heywood Faculty of Computer Science, Dalhousie University tupper@cs.dal.ca zincir@cs.dal.ca August 31, 2007 Abstract:
Modular Network Security. Tyler Carter, McAfee Network Security
Modular Network Security Tyler Carter, McAfee Network Security Surviving Today s IT Challenges DDos BOTS PCI SOX / J-SOX Data Exfiltration Shady RAT Malware Microsoft Patches Web Attacks No Single Solution
SECURITY RISK MANAGEMENT. FIRST 2007 Seville, Spain
SECURITY RISK MANAGEMENT FROM TECHNOLOGY VISION TO MARKET REALITY Avi Corfas, VP EMEA Skybox Security FIRST 2007 Seville, Spain Topics The Risk Assessment Challenge What Is IT Security Risk Management?
Looking at the SANS 20 Critical Security Controls
Looking at the SANS 20 Critical Security Controls Mapping the SANS 20 to NIST 800-53 to ISO 27002 by Brad C. Johnson The SANS 20 Overview SANS has created the 20 Critical Security Controls as a way of
Penetration Testing and Vulnerability Scanning
Penetration Testing and Vulnerability Scanning Presented by Steve Spearman VP of HIPAA Compliance Services, Healthicity 20 years in Health Information Technology HIPAA Expert and Speaker Disclaimer: Nothing
CORE Security and NIST
CORE Security and NIST Putting NIST Guidelines for Information Security Continuous Monitoring into Practice CORE Security +1 617.399-6980 info@coresecurity.com www.coresecurity.com blog.coresecurity.com
NEXPOSE ENTERPRISE METASPLOIT PRO. Effective Vulnerability Management and validation. March 2015
NEXPOSE ENTERPRISE METASPLOIT PRO Effective Vulnerability Management and validation March 2015 KEY SECURITY CHALLENGES Common Challenges Organizations Experience Key Security Challenges Visibility gaps
Enterprise Cybersecurity Best Practices Part Number MAN-00363 Revision 006
Enterprise Cybersecurity Best Practices Part Number MAN-00363 Revision 006 April 2013 Hologic and the Hologic Logo are trademarks or registered trademarks of Hologic, Inc. Microsoft, Active Directory,
CTS2134 Introduction to Networking. Module 8.4 8.7 Network Security
CTS2134 Introduction to Networking Module 8.4 8.7 Network Security Switch Security: VLANs A virtual LAN (VLAN) is a logical grouping of computers based on a switch port. VLAN membership is configured by
Vulnerability Audit: Why a Vulnerability Scan Isn t Enough. White Paper
Vulnerability Audit: Why a Vulnerability Scan Isn t Enough White Paper May 10, 2005 TABLE OF CONTENTS Introduction: How Secure Are My Systems?... 3 Vulnerability: The Modern Meaning Of A Muddled Word...
The Protection Mission a constant endeavor
a constant endeavor The IT Protection Mission a constant endeavor As businesses become more and more dependent on IT, IT must face a higher bar for preparedness Cyber preparedness is the process of ensuring