FIRST Conference ISOC CARIS Workshop ACDC European Cyber Defence Pilot Experience
|
|
|
- James Goodwin
- 8 years ago
- Views:
Transcription
1 FIRST Conference ISOC CARIS Workshop ACDC European Cyber Defence Pilot Experience Ulrich Seldeslachts, Berlin, June 19th, 2015 Constantly Under Attack Avg Malicious Sessions / day per vertical Sources : digitalattackmap.com Possible Origin Source : Unit42, PA Wildfire, Threat Trend December 2014 Source : GlobalThreatMap Today 2 1
2 Flow 1. Botnet Relevance? 2. SIEM Next Step : Information Sharing 3. ACDC : European Advanced Cyber Defense Center 4. About LSEC Leaders in Security LSEC, 2014, Public Closed User Group Distribution, p 3 3 Flow 1. Botnet Relevance? 2. SIEM Next Step : Information Sharing 3. ACDC : European Advanced Cyber Defense Center 4. About LSEC Leaders in Security LSEC, 2014, Public Closed User Group Distribution, p 4 4 2
3 Botnets? Leaders in Security LSEC, 2014, Public Closed User Group Distribution, p 5 What Botnets do Leaders in Security LSEC, 2014, for ACDC public, p 6 Source : PCWorld 3
4 Botnet 1 : Centralised Botnet 2 : P2P Botnet 3 : Fast Flux Botnet 4 : Locomotive Leaders in Security LSEC, 2014, for ACDC public, p 7 Source : ENISA, 2011 : Botnets : Detection, Measurement,... Botnet History Leaders in Security LSEC, 2014, Public Closed User Group Distribution, p 8 Source : RAND, Market for CyberCrime,
5 Bots? Leaders in Security LSEC, 2014, Public Closed User Group Distribution, p 9 Source : RAND, Market for CyberCrime, 2014 Botnets today? DDoS Leaders in Security LSEC, 2014, Public Closed User Group Distribution, p 10Source : Incapsula, Imperva, 11/2014 5
6 Botnets tomorrow : More Sophistication Volumetric DDoS Attacks brute force with increasing amplification? DNS Infrastructure Attacks? dns resolver cache flood - taking down nameservers? HTTP attacks brute force against webservers? Malicious Payloads exploit server vulnerabilities ShellShock Weaponize Attacks AWS Botnet? New Large Botnets Should we pick 1? Source : Cloudfare, December 2014 (Botconf) Leaders in Security LSEC, 2014, Public Closed User Group Distribution, p 11 Botnet is Big Business : Example RBN Leaders in Security LSEC, 2014, Public Closed User Group Distribution, p 12 Source : Cyberdefcon 03/2014 at LSEC, Infosecurity 12 6
7 Using webservices, Botnet as a Service, Leaders in Security LSEC, 2014, Public, p 13 Source : McAfee, Cybercrime Exposed, October 2013 Doesn t impact your business? Leaders in Security LSEC, 2014, Public, p 14 Source : IBM, X-Force Trends Report 09/
8 Attribution : top causes of data breaches Leaders in Security LSEC, 2014, Public, p 15 Source : ISTR, October 2013, But who cares? Business? not really Leaders in Security LSEC, 2014, for ACDC public, p 16 Source : LSEC, Innovations, Websense, 09/13 8
9 Should we even care? Leaders in Security LSEC, 2014, for ACDC public, p 17 Source : LSEC ACDC, Cyberdefcon March Carna Botnet : bots a research project Leaders in Security LSEC, 2014, for ACDC public, p 18 Source : LSEC, ACDC, Cyberdefcon 03/
10 The point? Leaders in Security LSEC, 2014, for ACDC public, p 19 Source : Marc Elsberg, Blackout, Global Threat Map Today Leaders in Security LSEC, 2014, for ACDC public, p 20 Source : Hostexploit, March
11 Botnet Relevance for Business Leaders in Security LSEC, 2014, for ACDC public, p 21 Source : various, GoDaddy, Checkpoint Why Information Sharing? Business Case components for trusted sharing Leaders in Security LSEC, 2014, Public Closed User Group Distribution, p 22 11
12 Source : Forrester Research, 2014 Leaders in Security LSEC, 2014, Public Closed User Group Distribution, p 23 Not alone need to differentiate Leaders in Security LSEC, 2014, Public Closed User Group Distribution, p 24 12
13 The need for Active Defense Source : RSA Conference, OpenDNS, 02/14 Leaders in Security LSEC, 2014, Public Closed User Group Distribution, p 25 The Threat landscape Source : Symantec, Deepsight EWS, 2012 Leaders in Security LSEC, 2014, Public Closed User Group Distribution, p 26 13
14 Threat landscape Source : Symantec, Deepsight EWS, 2012 Leaders in Security LSEC, 2014, Public Closed User Group Distribution, p 27 Threats are BIG Volume Velocity Velocity Variety Leaders in Security LSEC, 2014, Public Closed User Group Distribution, p 28 14
15 The Methodology : 1 Collect and Store Security Data Traditional Security Operations and Technology Logs Events Alerts People Advanced Security Intelligence and Analytics System audit trails Configuration information Network flows and anomalies External threat feeds Identity context Malware information Data Applications Infrastructure Monitor Everything Source : LSEC Big Data, IBM 0/14 Leaders in Security LSEC, 2014, Public Closed User Group Distribution, p 29 The Methodology : 2 Real-time and historical analysis Captured Detected Inferred Descriptive Analytics What happened? How many, how often, where? What exactly is the problem? What is the impact? Historic and Predictive Analytics Has it happened before? What if these trends continue? What might happen next? Decision modeling What actions can we take? How can we avoid this in future? How can we mitigate risk? Data Information Source : LSEC Big Data, IBM 0/14 Leaders in Security LSEC, 2014, Public Closed User Group Distribution, p 30 15
16 Operations Incident Handling Source : LSEC Hardening, CrossRoad 03/14 Leaders in Security LSEC, 2014, Public Closed User Group Distribution, p 31 Operations Incident Handling : reducing attacker free time Attacker Surveillance Target Analysis Access Probe Attack Set-up System Intrusion Attack Begins Discovery/ Persistence Cover-up Starts Leap Frog Attacks Complete Cover-up Complete Maintain foothold TIME ATTACKER FREE TIME TIME Physical Security Threat Analysis Defender Discovery Attack Forecast Source: NERC HILF Report, June 2010 ( Monitoring & Controls Incident Reporting Attack Identified Containment & Eradication Damage Identification Impact Analysis System Reaction Source : LSEC Big Data, RSA, 01/13 Leaders in Security LSEC, 2014, Public Closed User Group Distribution, p 32 Response Recovery 16
17 Big Data in Security Events * Indicator of Compromise Source : RSA Conference, Intel 03/14 Leaders in Security LSEC, 2014, Public Closed User Group Distribution, p 33 Analysis of incidents and threats * Indicator of Compromise Source : RSA Conference, Intel 03/14 Leaders in Security LSEC, 2014, Public Closed User Group Distribution, p 34 17
18 Breach Notification required / voluntary Leaders in Security LSEC, 2014, Public Closed User Group Distribution, p 35 Example Regulatory : Telecom Leaders in Security LSEC, 2014, Public Closed User Group Distribution, p 36 18
19 Those looking to multiply their knowledge, should be prepared to share some first Leaders in Security LSEC, 2014, Public Closed User Group Distribution, p 37 Example Voluntary Information Sharing Leaders in Security LSEC, 2014, Public Closed User Group Distribution, p 38 19
20 Example Voluntary Information Sharing Source : LSEC NCSC, InfoSharing, MACSSA, 2014 Leaders in Security LSEC, 2014, Public Closed User Group Distribution, p 39 Information Sharing : NISP Survey Results Leaders in Security LSEC, 2014, for ACDC public, p 40 Source : NISP, WG2, 3rd plenary,
21 Howto : Incident Management Tools Effective Cyber Threat Intelligence and Information Sharing Leaders in Security LSEC, 2014, for ACDC public, p 41 Information Sharing : commonalities, no conflict Leaders in Security LSEC, 2014, Public Closed User Group Distribution, p 42 21
22 ACDC Join the community! US DHS FIRST ADCC LSEC July 2014 Representatives of NATO, industry, end users, CERTs, ACDC Advanced Cyber Defence Center Leaders in Security LSEC, 2014, Public Closed User Group Distribution, p 44 22
23 Fragmented response Source : ENISA, 2012 : DG INFSO CIP PSP Leaders in Security LSEC, 2014, Public Closed User Group Distribution, p partners 14 countries Leaders in Security LSEC, 2014, Public Closed User Group Distribution, p
24 WP2 Pilot Components & Technology Development Tools : (1) Sensors and detection tools for networks (2) Systems Infections infected websites analysis (3) Device Detection and mitigation multi-purpose tools for end users (4) Centralized Data Clearing House and (5) Pan-European Support Centre, T2.1: Establishing and Management of Pilot Governance Group. (LSEC) [M01-M27] T2.2 : Developing Technology Framework (ATOS) [M01-M06] T2.3 : Developing Pilot Component Task Forces (LSEC) [M01-M21] T.2.4 : Pilot Component Developments (LSEC, TID) [M03-M23] T2.5 : Change management (LSEC) [M06-M27] T2.6 : Component Development Quality control management (LSEC) [M06-M27] Leaders in Security LSEC, 2013, Private & Confidential, p 47 Leaders in Security LSEC, 2014, Public Closed User Group Distribution, p 47 AC up to today DC 1. Achievement Highlights 1. Collaboration 28 partners, 14 countries, +40 external partners 2. Sensors operational, sensing, analyzing, reporting locally & sending data to Central Clearing House (CCH) 3. New sensors installed & operational (eg Darknet) 4. CCH operational and collecting and transmitting data (JSON, YAML), STIX integration 5. Decentralized Data Analysis with 6 different industrial partners 6. Reporting into CERTs, ISP s, LEA s end users 7. Setup of 11 National Support Centers 8. Different resulting tools : Mobile, Ransomware, Website Check, 2. Challenges Highlights 1. Regulatory Framework : Data Protection vs Monitoring 1. Consent 2. Controlled : 1. ISPs CERTs by exception 2. Industry delegated 2. Performance & Capability of Detection & Takedown 3. Sustainability of the Community : sign up today! Leaders in Security LSEC, 2014, Public Closed User Group Distribution, p 48 24
25 Data Sharing : Example & Effect CARNet creates identified threat information and sends the information to ACDC CCH The XLAB Android IDS infrastructure queries the CCH to obtain threat information provided by CARNet and blocks access to suspicious sites. Leaders in Security LSEC, 2014, Public Closed User Group Distribution, p 49 XLAB Mobile IDS : Device Monitor Source : K&A Virus Tracker, Botconf 2014 Source : ACDC Internal, XLAB, 2014 Leaders in Security LSEC, 2014, Public Closed User Group Distribution, p 50 25
26 Available on Google Play Store =eu.acdc.xlab.devicemonitor Demo videos: Tools in Production to Solutions ATOS AHPS, commercial SIEM CCH STIX Security Probe SL-SIEM dashboard Snort Syslog SL-SIEM server SIEM Agent + Plug-ins Nessu s Securit y Probe MySQL Nmap Security Probe Arpwatch ATOS, 2014 Leaders in Security LSEC, 2014, Public Closed User Group Distribution, p
27 Tools in Production to Solutions ATOS Netflow Behavorial Analysis Internet Blacklists Whitelists Sub-net Network device Netflow Netflow Behaviour Analysis Module CCH (Rourter Switch) Suspicious Domains, IPs, DNS servers softflow Netflow ATOS, 2014 Leaders in Security LSEC, 2014, Public Closed User Group Distribution, p 53 Darknet Subpilot A Darknet is a portion of routed, allocated IP space in which no active services or servers reside. These are "dark" because there is, seemingly, nothing within these networks. A Darknet does in fact include at least one server, designed as a packet vacuum. This server gathers the packets and flows that enter the Darknet, useful for real-time analysis or post-event network forensics. Any packet that enters a Darknet is by its presence aberrant. No legitimate packets should be sent to a Darknet. Such packets may have arrived by mistake or misconfiguration, but the majority of such packets are sent by malware and BOTNETS! Leaders in Security LSEC, 2014, Public Closed User Group Distribution, p 54 27
28 Darknet Subpilot Darknet Results : Most Seen ASN s Providing Input into : Hostexploits Report on Zeus Botnet Source : March 2014 Leaders in Security LSEC, 2014, Public Closed User Group Distribution, p User Tools & impact Leaders in Security LSEC, 2014, for ACDC public, p
29 User Tools & Impact Leaders in Security LSEC, 2014, for ACDC public, p antibot.hr Leaders in Security LSEC, 2014, Public Closed User Group Distribution, p
30 ACDC Online 1 : End User Connecting users to solutions through a set of European support centres Leaders in Security LSEC, 2014, Public Closed User Group Distribution, p 59 ACDC Online 2 : Project Operating as a European pilot project Leaders in Security LSEC, 2014, Public Closed User Group Distribution, p 60 30
31 ACDC Online 3 : Community Operating as a community Joining forces to fight botnets Sharing intelligence Learning from tools & technologies and effects Expert network Leaders in Security LSEC, 2014, Public Closed User Group Distribution, p 61 ACDC Online 3 : Community Leaders in Security LSEC, 2014, Public Closed User Group Distribution, p 62 31
32 ACDC Online 4 : Future CCH Connection Leaders in Security LSEC, 2014, Public Closed User Group Distribution, p 63 ACDC Online 3 : Community Internet Security Days Leaders in Security LSEC, 2014, Public Closed User Group Distribution, p 64 32
33 ACDC Online 3 : Community Leaders in Security LSEC, 2014, Public Closed User Group Distribution, p 65 About LSEC Leaders in Security LSEC, 2014, Public Closed User Group Distribution, p 66 33
34 About LSEC & the Belgian R2GS Chapter Ulrich Seldeslachts, Paris, December 17th, 2014 Leaders in Security LSEC, 2014, Public Closed User Group Distribution, p 68 34
35 Leaders in Security LSEC, 2014, Public Closed User Group Distribution, p
36 About LSEC Summary 1. Leaders In Security : a non-profit Flemish (vzw) industry association and user community supporting innovation & development of information security 1. Data protection : protection of data, users, information and systems, 2. Security management : standards, legal, good practices 3. Tools and technologies : networking, encryption, virtualization 2. Over 135 members, e-security companies, reaching out to more than ict professionals and security professionals, operations in Be, Nl, UK 3. Strategic partnes in ICT, TMT, Industry, Finance, Healthcare, Energy, and in Germany, UK, Spain, France, Italy, Czech Republic, Ireland, US, 4. Various international projects 1. FIRE 2. ACDC 3. NEBUCOM 4. IPACSO 5. Key competences : 1. Dissemination - Outreach 2. End user relations 3. Business & Validation 4. Impact Coordination 5. Strategy & Innovation 5. More than 100 activities per year in Belgium and abroad : 1. Seminars, Conferences, trade shows, 2. with over 5000 documents (white papers, business cases, presentations, on information security related matters) 3. Regular news letters, invitations, discussion for a Visit for more information and documenation Leaders in Security LSEC, 2014, Public Closed User Group Distribution, p 72 36
37 Leaders in Security LSEC, 2014, Private & Confidential, p 73 NOT THE END More information and follow-up Q or C Ulrich Seldeslachts ulrich@lsec.be Leaders in Security LSEC, 2014, Private & Confidential, p 74 37
BIG DATA. Shaun McLagan General Manager, RSA Australia and New Zealand CHANGING THE REALM OF POSSIBILITY IN SECURITY
BIG DATA CHANGING THE REALM OF POSSIBILITY IN SECURITY Shaun McLagan General Manager, RSA Australia and New Zealand 1 Things have changed #2 Buzz word 2012 Big Data only behind something called Fiscal
Getting Ahead of Advanced Threats
Getting Ahead of Advanced Threats Advanced Security Solutions for Trusted IT Chezki Gil Territory Manager Israel & Greece 1 Threats are Evolving Rapidly Criminals Petty criminal s Unsophisticated Organized
The Next Generation Security Operations Center
The Next Generation Security Operations Center Vassil Barsakov Regional Manager, CEE & CIS RSA, the Security Division of EMC 1 Threats are Evolving Rapidly Criminals Petty criminals Unsophisticated Organized
BREAKING THE KILL CHAIN AN EARLY WARNING SYSTEM FOR ADVANCED THREAT
BREAKING THE KILL CHAIN AN EARLY WARNING SYSTEM FOR ADVANCED THREAT Rashmi Knowles RSA, The Security Division of EMC Session ID: Session Classification: SPO-W07 Intermediate APT1 maintained access to
Rashmi Knowles Chief Security Architect EMEA
Rashmi Knowles Chief Security Architect EMEA AGENDA Transformation of IT New cyber-security challenges Intelligence Driven Security Security Analytics Q&A 2 ENTERPRISE DATA CENTER ADVANCED SECURITY A UNIQUE
The Future of the Advanced SOC
The Future of the Advanced SOC Developing a platform for more effective security management and compliance Steven Van Ormer RSA Technical Security Consultant 1 Agenda Today s Security Landscape and Why
RSA Security Anatomy of an Attack Lessons learned
RSA Security Anatomy of an Attack Lessons learned Malcolm Dundas Account Executive John Hurley Senior Technology Consultant 1 Agenda Advanced Enterprise/ Threats The RSA Breach A chronology of the attack
The Cyber Threat Profiler
Whitepaper The Cyber Threat Profiler Good Intelligence is essential to efficient system protection INTRODUCTION As the world becomes more dependent on cyber connectivity, the volume of cyber attacks are
Using Monitoring, Logging, and Alerting to Improve ICS Security ICSJWG 2015 Fall Meeting October 27, 2015
www.encari.com Using Monitoring, Logging, and Alerting to Improve ICS Security ICSJWG 2015 Fall Meeting October 27, 2015 www.encari.com 2 The Problem Cyber attacks are not just a risk, they are a reality.
Attackers are highly skilled, persistent, and very motivated at finding and exploiting new vectors. Microsoft Confidential for internal use only
Attackers are highly skilled, persistent, and very motivated at finding and exploiting new vectors Microsoft Confidential for internal use only Wall Street Journal, JP Morgan, Lockheed, Bushehr nuclear
Practical Steps To Securing Process Control Networks
Practical Steps To Securing Process Control Networks Villanova University Seminar Rich Mahler Director, Commercial Cyber Solutions Lockheed Martin Lockheed Martin Corporation 2014. All Rights Reserved.
QRadar SIEM and FireEye MPS Integration
QRadar SIEM and FireEye MPS Integration March 2014 1 IBM QRadar Security Intelligence Platform Providing actionable intelligence INTELLIGENT Correlation, analysis and massive data reduction AUTOMATED Driving
First Line of Defense
First Line of Defense SecureWatch ANALYTICS FIRST LINE OF DEFENSE OVERVIEW KEY BENEFITS Comprehensive Visibility Powerful web-based security analytics portal with easy-to-read security dashboards Proactive
24/7 Visibility into Advanced Malware on Networks and Endpoints
WHITEPAPER DATA SHEET 24/7 Visibility into Advanced Malware on Networks and Endpoints Leveraging threat intelligence to detect malware and exploitable vulnerabilities Oct. 24, 2014 Table of Contents Introduction
The SIEM Evaluator s Guide
Using SIEM for Compliance, Threat Management, & Incident Response Security information and event management (SIEM) tools are designed to collect, store, analyze, and report on log data for threat detection,
Advanced Persistent Threats
Advanced Persistent Threats Craig Harwood Channel Manager SADC and Indian Ocean Islands 1 Agenda Introduction Today s Threat landscape What is an Advance persistent Threat How are these crimes perpetrated
SR B17. The Threat Landscape Continues to Change: How are You Keeping Pace? Dean Turner
SR B17 The Threat Landscape Continues to Change: How are You Keeping Pace? Dean Turner Director - Engineering, Global Intelligence Network Symantec Intelligence Group Agenda 1 2 3 5 Symantec Intelligence
Using Network Forensics to Visualize Advanced Persistent Threats
Using Network Forensics to Visualize Advanced Persistent Threats Dale Long, Sr. Technology Consultant, RSA Security 1 The Problem 2 Traditional Security Is Not Working 99% of breaches led to compromise
Comprehensive Malware Detection with SecurityCenter Continuous View and Nessus. February 3, 2015 (Revision 4)
Comprehensive Malware Detection with SecurityCenter Continuous View and Nessus February 3, 2015 (Revision 4) Table of Contents Overview... 3 Malware, Botnet Detection, and Anti-Virus Auditing... 3 Malware
Emerging Network Security Threats and what they mean for internal auditors. December 11, 2013 John Gagne, CISSP, CISA
Emerging Network Security Threats and what they mean for internal auditors December 11, 2013 John Gagne, CISSP, CISA 0 Objectives Emerging Risks Distributed Denial of Service (DDoS) Attacks Social Engineering
Cyber Security. BDS PhantomWorks. Boeing Energy. Copyright 2011 Boeing. All rights reserved.
Cyber Security Automation of energy systems provides attack surfaces that previously did not exist Cyber attacks have matured from teenage hackers to organized crime to nation states Centralized control
Environment. Attacks against physical integrity that can modify or destroy the information, Unauthorized use of information.
Cyber Security. Environment, Solutions and Case study. Special Telecommunications Service David Gabriel, Buciu Adrian Contact: gdavid13@sts.ro adibuciu@sts.ro Environment Network/services can be damaged
Defending Against Data Beaches: Internal Controls for Cybersecurity
Defending Against Data Beaches: Internal Controls for Cybersecurity Presented by: Michael Walter, Managing Director and Chris Manning, Associate Director Protiviti Atlanta Office Agenda Defining Cybersecurity
Security Analytics for Smart Grid
Security Analytics for Smart Grid Dr. Robert W. Griffin Chief Security Architect RSA, the Security Division of EMC robert.griffin@rsa.com blogs.rsa.com/author/griffin @RobtWesGriffin 1 No Shortage of Hard
DDoS ATTACKS: MOTIVES, MECHANISMS AND MITIGATION
DDoS ATTACKS: MOTIVES, MECHANISMS AND MITIGATION Stephen Gates Chief Security Evangelist Corero Network Security Session ID: SEC-W04 Session Classification: Intermediate Recent Headlines Are Denial of
DNS Firewall Overview Speaker Name. Date
DNS Firewall Overview Speaker Name 1 1 Date Reserved. Agenda DNS Security Challenges DNS Firewall Solution Customers Call to Action 2 2 Reserved. APTs: The New Threat Landscape Nation-state or organized-crime
White Paper. Intelligent DDoS Protection Use cases for applying DDoS Intelligence to improve preparation, detection and mitigation
White Paper Intelligent DDoS Protection Use cases for applying DDoS Intelligence to improve preparation, detection and mitigation Table of Contents Introduction... 3 Common DDoS Mitigation Measures...
Beyond the Hype: Advanced Persistent Threats
Advanced Persistent Threats and Real-Time Threat Management The Essentials Series Beyond the Hype: Advanced Persistent Threats sponsored by Dan Sullivan Introduction to Realtime Publishers by Don Jones,
Cybercrime Metrics and Threat Data: Warsaw - Poland
Cybercrime Metrics and Threat Data: Warsaw - Poland What are the Current Trends? Who? Why? and Where? Jart Armin HostExploit CyberDefcon - CyberROAD Jart Armin NGO - Research group for Cyber threat analysis
Advanced Visibility. Moving Beyond a Log Centric View. Matthew Gardiner, RSA & Richard Nichols, RSA
Advanced Visibility Moving Beyond a Log Centric View Matthew Gardiner, RSA & Richard Nichols, RSA 1 Security is getting measurability worse Percent of breaches where time to compromise (red)/time to Discovery
Staying Secure After Microsoft Windows Server 2003 Reaches End of Life. Trevor Richmond, Sales Engineer Trend Micro
Staying Secure After Microsoft Windows Server 2003 Reaches End of Life Trevor Richmond, Sales Engineer Trend Micro Windows Server 2003 End of Life- Why Care? The next big vulnerability (Heartbleed/Shellshock)
The Changing Nature of Risk and the Role of Big Data
The Changing Nature of Risk and the Role of Big Data Jack Danahy Director / North American Security Consulting IBM Incidents Continue to Grow in Spite of Investment 2012 Sampling of Security Incidents
SANS Top 20 Critical Controls for Effective Cyber Defense
WHITEPAPER SANS Top 20 Critical Controls for Cyber Defense SANS Top 20 Critical Controls for Effective Cyber Defense JANUARY 2014 SANS Top 20 Critical Controls for Effective Cyber Defense Summary In a
Next Generation IPS and Reputation Services
Next Generation IPS and Reputation Services Richard Stiennon Chief Research Analyst IT-Harvest 2011 IT-Harvest 1 IPS and Reputation Services REPUTATION IS REQUIRED FOR EFFECTIVE IPS Reputation has become
Software that provides secure access to technology, everywhere.
Software that provides secure access to technology, everywhere. Joseph Patrick Schorr @JoeSchorr October, 2015 2015 BOMGAR CORPORATION ALL RIGHTS RESERVED WORLDWIDE 1 Agenda What are we dealing with? How
Managing Web Security in an Increasingly Challenging Threat Landscape
Managing Web Security in an Increasingly Challenging Threat Landscape Cybercriminals have increasingly turned their attention to the web, which has become by far the predominant area of attack. Small wonder.
Take the Red Pill: Becoming One with Your Computing Environment using Security Intelligence
Take the Red Pill: Becoming One with Your Computing Environment using Security Intelligence Chris Poulin Security Strategist, IBM Reboot Privacy & Security Conference 2013 1 2012 IBM Corporation Securing
Who s Doing the Hacking?
Who s Doing the Hacking? 1 HACKTIVISTS Although the term hacktivist refers to cyber attacks conducted in the name of political activism, this segment of the cyber threat spectrum covers everything from
Advanced Threats: The New World Order
Advanced Threats: The New World Order Gary Lau Technology Consulting Manager Greater China gary.lau@rsa.com 1 Agenda Change of Threat Landscape and Business Impact Case Sharing Korean Incidents EMC CIRC
Cyber Security Metrics Dashboards & Analytics
Cyber Security Metrics Dashboards & Analytics Feb, 2014 Robert J. Michalsky Principal, Cyber Security NJVC, LLC Proprietary Data UNCLASSIFIED Agenda Healthcare Sector Threats Recent History Security Metrics
Intel Security Certified Product Specialist Security Information Event Management (SIEM)
Intel Security Certified Product Specialist Security Information Event Management (SIEM) Why Get Intel Security Certified? As technology and security threats continue to evolve, organizations are looking
First Line of Defense
First Line of Defense SecureWatch ANALYTICS FIRST LINE OF DEFENSE OVERVIEW KEY BENEFITS Comprehensive Visibility Gain comprehensive visibility into DDoS attacks and cyber-threats with easily accessible
Combating a new generation of cybercriminal with in-depth security monitoring. 1 st Advanced Data Analysis Security Operation Center
Combating a new generation of cybercriminal with in-depth security monitoring 1 st Advanced Data Analysis Security Operation Center The Challenge Don t leave your systems unmonitored. It takes an average
The session is about to commence. Please switch your phone to silent!
The session is about to commence. Please switch your phone to silent! 1 Defend with Confidence Against Advanced Threats Nicholas Chia SE Manager, SEA RSA 2 TRUST? Years to earn, seconds to break 3 Market
O N L I N E I N C I D E N T R E S P O N S E C O M M U N I T Y
Automate Response Congratulations on selecting IncidentResponse.com to retrieve your custom incident response workflow guide. This guide has been created especially for you for use in within your security
2012 Bit9 Cyber Security Research Report
2012 Bit9 Cyber Security Research Report Table of Contents Executive Summary Survey Participants Conclusion Appendix 3 4 10 11 Executive Summary According to the results of a recent survey conducted by
A Case for Managed Security
A Case for Managed Security By Christopher Harper Managing Director, Security Superior Managed IT & Security Services 1. INTRODUCTION Most firms believe security breaches happen because of one key malfunction
Securing Your Business with DNS Servers That Protect Themselves
Product Summary: The Infoblox Secure DNS Solution mitigates attacks on DNS servers by intelligently recognizing various attack types and dropping attack traffic while responding only to legitimate queries.
Effective IDS/IPS Network Security in a Dynamic World with Next-Generation Intrusion Detection & Prevention
Effective IDS/IPS Network Security in a Dynamic World with Next-Generation Intrusion Detection & Prevention Your Security Challenges Defending the Dynamic Network! Dynamic threats 䕬 䕬 䕬 䕬 Many threats
WHEN THE HUNTER BECOMES THE HUNTED HUNTING DOWN BOTNETS USING NETWORK TRAFFIC ANALYSIS
WHEN THE HUNTER BECOMES THE HUNTED HUNTING DOWN BOTNETS USING NETWORK TRAFFIC ANALYSIS /ABOUT/ME Thomas Chopitea - Incident handler @CertSG Digital forensics & incident response (#DFIR), malware analysis,
Microsoft s cybersecurity commitment
Microsoft s cybersecurity commitment Published January 2015 At Microsoft, we take the security and privacy of our customers data seriously. This focus has been core to our culture for more than a decade
81% of participants believe the government should share more threat intelligence with the private sector.
Threat Intelligence Sharing & the Government s Role in It Results of a Survey at InfoSec 2015 Section 1 1.1 Executive summary The last few years has seen a rise in awareness regarding security breaches
Security Incident Management Essentials Compiled as a service to the community by Internet2, EDUCAUSE, and REN-ISAC
Compiled as a service to the community by Internet2, EDUCAUSE, and REN-ISAC Background and Overview The Computer Security Incidents Internet2 (CSI2) working group organizes activities to better identify
RSA Security Analytics
RSA Security Analytics This is what SIEM was Meant to Be 1 The Original Intent of SIEM Single compliance & security interface Compliance yes, but security? Analyze & prioritize alerts across various sources
SECURITY MEETS BIG DATA. Achieve Effectiveness And Efficiency. Copyright 2012 EMC Corporation. All rights reserved.
SECURITY MEETS BIG DATA Achieve Effectiveness And Efficiency 1 IN 2010 THE DIGITAL UNIVERSE WAS 1.2 ZETTABYTES 1,000,000,000,000,000,000,000 Zetta Exa Peta Tera Giga Mega Kilo Byte Source: 2010 IDC Digital
Unified Cyber Security Monitoring and Management Framework By Vijay Bharti Happiest Minds, Security Services Practice
Unified Cyber Security Monitoring and Management Framework By Vijay Bharti Happiest Minds, Security Services Practice Introduction There are numerous statistics published by security vendors, Government
Cyber Defense & Breach Response Privacy Issues
Cyber Defense & Breach Response Privacy Issues Kevin Boyle Partner 17 November 2014 Latham & Watkins is the business name of Latham & Watkins (London) LLP, a registered limited liability partnership organised
Making Your Enterprise SSL Security Less of a Gamble
Making Your Enterprise SSL Security Less of a Gamble Rob Glickman Sr. Director, Product Marketing Amar Doshi Sr. Manager, Product Management Symantec Vision 2012 The VeriSign Seal is Now the Norton Secured
Intrusion Forecasting Framework for Early Warning System against Cyber Attack
Intrusion Forecasting Framework for Early Warning System against Cyber Attack Sehun Kim KAIST, Korea Honorary President of KIISC Contents 1 Recent Cyber Attacks 2 Early Warning System 3 Intrusion Forecasting
IBM Security Strategy
IBM Security Strategy Intelligence, Integration and Expertise Kate Scarcella CISSP Security Tiger Team Executive M.S. Information Security IBM Security Systems IBM Security: Delivering intelligence, integration
Windows Server 2003 End of Support. What does it mean? What are my options?
Windows Server 2003 End of Support What does it mean? What are my options? Windows Server 2003 End of Life- Why Care? The next big vulnerability (Heartbleed/Shellshock) is looming No more patches from
Ahead of the threat with Security Intelligence
Ahead of the threat with Security Intelligence PITB Information Security Conference 2013 Zoaib Nafar Brand Technical Sales Lead 2012 IBM Corporation 1 The world is becoming more digitized and interconnected,
The webinar will begin shortly
The webinar will begin shortly An Introduction to Security Intelligence Presented by IBM Security Chris Ross Senior Security Specialist, IBM Security Agenda The Security Landscape An Introduction to Security
Symantec Cyber Threat Analysis Program Program Overview. Symantec Cyber Threat Analysis Program Team
Symantec Cyber Threat Analysis Program Symantec Cyber Threat Analysis Program Team White Paper: Symantec Security Intelligence Services Symantec Cyber Threat Analysis Program Contents Overview...............................................................................................
Mucho Big Data y La Seguridad para cuándo?
Mucho Big Data y La Seguridad para cuándo? Juan Carlos Vázquez Sales Systems Engineer, LTAM mayo 9, 2013 Agenda Business Drivers Big Security Data GTI Integration SIEM Architecture & Offering Why McAfee
Network Monitoring for Cyber Security
Network Monitoring for Cyber Security Paul Krystosek, PhD CERT Network Situational Awareness 2006 Carnegie Mellon University What s Coming Up The scope of network monitoring Cast of characters Descriptions
RSA Security Analytics the complete approach to security monitoring or how to approach advanced threats
RSA Security Analytics the complete approach to security monitoring or how to approach advanced threats Grzegorz Mucha grzegorz.mucha@rsa.com Advanced Threats Threat Landscape Criminals Petty criminals
IBM SECURITY QRADAR INCIDENT FORENSICS
IBM SECURITY QRADAR INCIDENT FORENSICS DELIVERING CLARITY TO CYBER SECURITY INVESTIGATIONS Gyenese Péter Channel Sales Leader, CEE IBM Security Systems 12014 IBM Corporation Harsh realities for many enterprise
Securing OS Legacy Systems Alexander Rau
Securing OS Legacy Systems Alexander Rau National Information Security Strategist Sample Agenda 1 Today s IT Challenges 2 Popular OS End of Support & Challenges for IT 3 How to protect Legacy OS systems
Report on Cyber Security Alerts Processed by CERT-RO in 2014
Section III - Cyber-Attacks Evolution and Cybercrime Trends Report on Cyber Security Alerts Processed by CERT-RO in 2014 Romanian National Computer Security Incident Response Team office@cert-ro.eu The
JUNIPER NETWORKS SPOTLIGHT SECURE THREAT INTELLIGENCE PLATFORM
JUNIPER NETWORKS SPOTLIGHT SECURE THREAT INTELLIGENCE PLATFORM May 2015 Nguyễn Tiến Đức ASEAN Security Specialist Agenda Modern Malware: State of the Industry Dynamic Threat Intelligence on the Firewall
Cyber Resilience Implementing the Right Strategy. Grant Brown Security specialist, CISSP @TheGrantBrown
Cyber Resilience Implementing the Right Strategy Grant Brown specialist, CISSP @TheGrantBrown 1 2 Network + Technology + Customers = $$ 3 Perfect Storm? 1) Increase in Bandwidth (extended reach) 2) Available
Separating Signal from Noise: Taking Threat Intelligence to the Next Level
SESSION ID: SPO2-T09 Separating Signal from Noise: Taking Threat Intelligence to the Next Level Doron Shiloach X-Force Product Manager IBM @doronshiloach Agenda Threat Intelligence Overview Current Challenges
Concierge SIEM Reporting Overview
Concierge SIEM Reporting Overview Table of Contents Introduction... 2 Inventory View... 3 Internal Traffic View (IP Flow Data)... 4 External Traffic View (HTTP, SSL and DNS)... 5 Risk View (IPS Alerts
Combating a new generation of cybercriminal with in-depth security monitoring
Cybersecurity Services Combating a new generation of cybercriminal with in-depth security monitoring 1 st Advanced Data Analysis Security Operation Center The Challenge Don t leave your systems unmonitored.
Security Solutions for the New Threads
Security Solutions for the New Threads We see things others can t Pablo Grande Sales Director, SOLA pgrande@arbor.net What a CISO Is Looking For Show Progress on Response Time Measurably improve our incident
Sorting out SIEM strategy Five step guide to full security information visibility and controlled threat management
Sorting out SIEM strategy Five step guide to full security information visibility and controlled threat management This guide will show you how a properly implemented and managed SIEM solution can solve
Using SIEM for Real- Time Threat Detection
Using SIEM for Real- Time Threat Detection Presentation to ISSA Baltimore See and secure what matters Joe Magee CTO and Co-Founder March, 27 2013 About us Vigilant helps clients build and operate dynamic,
External Supplier Control Requirements
External Supplier Control s Cyber Security For Suppliers Categorised as Low Cyber Risk 1. Asset Protection and System Configuration Barclays Data and the assets or systems storing or processing it must
Who Drives Cybersecurity in Your Business? Milan Patel, K2 Intelligence. AIBA Quarterly Meeting September 10, 2015
Who Drives Cybersecurity in Your Business? Milan Patel, K2 Intelligence AIBA Quarterly Meeting September 10, 2015 The Answer 2 Everyone The relationship between the board, C-suite, IT, and compliance leaders
Malicious Network Traffic Analysis
Malicious Network Traffic Analysis Uncover system intrusions by identifying malicious network activity. There are a tremendous amount of network based attacks to be aware of on the internet today and the
The Incident Response Playbook for Android and ios
SESSION ID: AIR-W03R The Incident Response Playbook for Android and ios Andrew Hoog CEO and Co-founder NowSecure @ahoog42 @NowSecureMobile Andrew Hoog Author of three books Incident Response for Android
WHITE PAPER WHAT HAPPENED?
WHITE PAPER WHAT HAPPENED? ENSURING YOU HAVE THE DATA YOU NEED FOR EFFECTIVE FORENSICS AFTER A DATA BREACH Over the past ten years there have been more than 75 data breaches in which a million or more
Cybersecurity Risk Management in the Telecom Sector. MUSTAPHA HUNEYD Corporate Information Security
Cybersecurity Risk Management in the Telecom Sector MUSTAPHA HUNEYD Corporate Information Security Cyber Security Risks World Economic Forum Global Risks 2014 - Ninth Edition Critical Infrastructure Critical
WAN security threat landscape and best mitigation practices. Rex Stover Vice President, Americas, Enterprise & ICP Sales
WAN security threat landscape and best mitigation practices. Rex Stover Vice President, Americas, Enterprise & ICP Sales The Cost of Cybercrime Sony $171m PlayStation 3 data breach (April 2011) $3 trillion
STOPPING LAYER 7 ATTACKS with F5 ASM. Sven Müller Security Solution Architect
STOPPING LAYER 7 ATTACKS with F5 ASM Sven Müller Security Solution Architect Agenda Who is targeted How do Layer 7 attacks look like How to protect against Layer 7 attacks Building a security policy Layer
Tripwire Log Center NEXT GENERATION LOG AND EVENT MANAGEMENT WHITE PAPER
Tripwire Log Center NEXT GENERATION LOG AND EVENT MANAGEMENT WHITE PAPER Introduction A decade or more ago, logs of events recorded by firewalls, intrusion detection systems and other network devices were
DYNAMIC DNS: DATA EXFILTRATION
DYNAMIC DNS: DATA EXFILTRATION RSA Visibility Reconnaissance Weaponization Delivery Exploitation Installation C2 Action WHAT IS DATA EXFILTRATION? One of the most common goals of malicious actors is to
Country Case Study on Incident Management Capabilities CERT-TCC, Tunisia
Country Case Study on Incident Management Capabilities CERT-TCC, Tunisia Helmi Rais CERT-TCC Team Manager National Agency for Computer Security, Tunisia helmi.rais@ansi.tn helmi.rais@gmail.com Framework
THREAT VISIBILITY & VULNERABILITY ASSESSMENT
THREAT VISIBILITY & VULNERABILITY ASSESSMENT Date: April 15, 2015 IKANOW Analysts: Casey Pence IKANOW Platform Build: 1.34 11921 Freedom Drive, Reston, VA 20190 IKANOW.com TABLE OF CONTENTS 1 Key Findings
Cyber Watch. Written by Peter Buxbaum
Cyber Watch Written by Peter Buxbaum Security is a challenge for every agency, said Stanley Tyliszczak, vice president for technology integration at General Dynamics Information Technology. There needs
and 26th november 2016
DDoS WHERE'S THE THREAT? and WHAT CAN YOU DO? 26th november 2016 Pieter Hanssens pieter.hanssens(at)belnet.be Thomas Eugène thomas.eugene(at)cert.be Presentation based on Whitepaper DDoS: Proactive and
Security strategies to stay off the Børsen front page
Security strategies to stay off the Børsen front page Steve Durkin, Channel Director for Europe, Q1 Labs, an IBM Company 1 2012 IBM Corporation Given the dynamic nature of the challenge, measuring the
Stephen Coty Director, Threat Research
Emerging threats facing Cloud Computing Stephen Coty Director, Threat Research Cloud Environments 101 Cloud Adoption is Gaining Momentum Cloud market revenue will increase at a 36% annual rate Analyst
Frost & Sullivan s. Aerospace, Defence & Security Practice. Global Industrial Cyber Security Trends
Frost & Sullivan s Aerospace, Defence & Security Practice Global Industrial Cyber Security Trends Presented by Philipp Reuter Director Frost & Sullivan, Turkey 1 Worth over $ 50 Billion globally in 2014
U. S. Attorney Office Northern District of Texas March 2013
U. S. Attorney Office Northern District of Texas March 2013 What Is Cybercrime? Hacking DDOS attacks Domain name hijacking Malware Other computer related offenses, i.e. computer and internet used to facilitate
CyberArk Privileged Threat Analytics. Solution Brief
CyberArk Privileged Threat Analytics Solution Brief Table of Contents The New Security Battleground: Inside Your Network...3 Privileged Account Security...3 CyberArk Privileged Threat Analytics : Detect
Defend Your Network with DNS Defeat Malware and Botnet Infections with a DNS Firewall
Defeat Malware and Botnet Infections with a DNS Firewall By 2020, 30% of Global 2000 companies will have been directly compromised by an independent group of cyberactivists or cybercriminals. How to Select
Securing Your Business with DNS Servers That Protect Themselves
Summary: The Infoblox DNS security product portfolio mitigates attacks on DNS/DHCP servers by intelligently recognizing various attack types and dropping attack traffic while responding only to legitimate