Ralf Kaltenbach, Regional Director Germany Arrow Sommerforum 2015
Unsere IT ist doch sicher 2
oder vielleicht doch nicht? 3
2015 VDBIR 4
VDBR - Hintergründe und High level Fakten Dozens of TBs of data One of the most collaborative, data-driven information security (InfoSec) reports in existence 70 contributors IR/forensic firms, CSIRTs, vendors & gov. agencies EMC CIRC Contributes The New York Times 2014: 700 articles related to data beaches 2013: Fewer than 125 5
High Level Findings Top 3 Ziele für Cyberangriffe: Public, Information companies, Financial Services (i.e. Banken und Versicherungen) Gefahren von innen signifikant, Schwerpunkt liegt jedoch immer noch auf Angriffen von extern. 6
Cyber-Espionage Detektion 99% % der Angriffe wurden NICHT durch logbasierende Technologien entdeckt % der Angriffe, bis zu deren Entdeckung mehrere 83% Wochen oder mehr vergingen - VERIZON 2015 DATA BREACH INVESTIGATIONS REPORT 7
Hohe Angreifergeschwindigkeit In 60 % aller analysierten Fälle waren die Angreifer dazu in der Lage, präventive Hürden binnen 60% Minuten zu überwinden. - VERIZON 2015 DATA BREACH INVESTIGATIONS REPORT 8
Hase und Igel: Angreifer haben die Nase vorn Attacker Capabilities The defender-detection deficit Defender Capabilities VERIZON 2015 DATA BREACH INVESTIGATIONS REPORT 9
Zwei Oberziele um ACD Angriffe abzuwehren 1 TARGETED SPECIFIC OBJECTIVE 2 STEALTHY 3 INTERACTIVE LOW AND SLOW HUMAN INVOLVEMENT System Intrusion Attack Begins Cover-Up Discovery Leap Frog Attacks Cover-Up Complete TIME Dwell Time Response Time 1 Dwell Time reduzieren Attack Identified Response 2 Reaktionsgeschwindigkeit erhöhen 10
BILLIONS OF USERS MILLIONS OF APPS 2010 HUNDREDS OF MILLIONS OF USERS Mobile Cloud Big Data Social Mobile Devices LAN/Internet 1990 PC Client/Server TENS OF THOUSANDS OF APPS MILLIONS OF USERS 1970 Mainframe, Mini Computer Terminals THOUSANDS OF APPS Source: IDC, 2012 RSA CONFIDENTIAL INTERNAL USE ONLY 11
12
Aktuelle Herausforderungen Ursache und Wirkung Identifikation neuer Bedrohungen Cloud Customers Partners Third-Parties Zugriffs- und Identitäts- Management Mobile Employees BYOD On- Prem Shadow IT Abwehr von Cybercrime Sicherstellung von Compliance 13
Neue Angriffsarten erfordern neue Qualität von Abwehr THREAT Simple Hacks Attacks Attack Campaigns NETWORK PROTECTION Firewall IDS NGFW / UTM IPS HOST PROTECTION A/V Malware Analytics DLP Host Forensics VISIBILITY ad hoc logging SIEM Network Forensics Network Forensics & Analytics REMEDIATION SERVICES N/A Specialists RSA CONFIDENTIAL INTERNAL USE ONLY 14
Threat Actors Firewall IDS/IPS Evolution of Threat Actors & Detection Implications At first, there were HACKS Preventative controls filter known attack paths AntiVirus Malicious Traffic Whitespace Successful HACKS Corporate Assets 15
Threat Actors Evolution of Threat Actors & Detection Implications Firewall IDS/IPS AntiVirus Malicious Traffic More Logs Blocked Session Blocked Session Blocked Session Alert S I E M At first, there were HACKS Preventative controls filter known attack paths Then, ATTACKS Despite increased investment in controls, including SIEM Whitespace Successful ATTACKS Corporate Assets 16
Threat Actors Firewall IDS/IPS AntiVirus Malicious Traffic Logs Endpoint VIsibility Network VIsibility Blocked Session Blocked Session Blocked Session Alert Process Network Sessions Security Analytics Evolution of Threat Actors & Detection Implications Now, successful ATTACK CAMPAIGNS target any and all whitespace. Complete visibility into every process and network sessions is required to eradicate the attacker opportunity. Unified platform for advanced threat detection & investigations, Corporate Assets 17
INTELLIGENCE DRIVEN SECURITY IN AKTION GOVERNANCE, RISK, & COMPLIANCE ANALYSE Threat Fraud Compliance Identity Cloud DATEN LOGS, PACKETS, NETFLOW, ENDPOINT, ID, VULNS, THREAT (INT & EXT) IDENTITY & ACCESS On Prem 18
Paradigmenwechsel in Security Monitoren 15% Reagieren 5% Monitoren 33% Reagieren 33% Vorsorge 80% Vorsorge 33% Prioritäten Heute Intelligence-Driven Security 19
RSA Security Analytics Architecture Visibility Analysis Action LIVE Cloud Packets Logs Capture Time Data Enrichment LIVE Security Operations Security Operations LIVE On Prem NetFlow Endpoint RSA LIVE INTELLIGENCE Threat Intelligence Rules Parsers Feeds Reports RSA Research 20
ASOC Portfolio Security Analytics Log Monitoring (SIEM) Security Analytics Network Monitoring & Forensics ECAT Web Threat Detection Security Operations (Archer) RSA s Incident Response Services 21
Kernelemente ACD Services 8 core ACD domains Reporting Business Alignment Assess maturity Comprehensive report RSA Methodology Recommendations Roadmap Incident response Defense In-depth Analytic Intelligence Core domains Threat Intelligence Risk alignment Content intelligence 22
MATURITY LEVEL PER DOMAIN 23
SA 10.5 Themes & Capabilities Verfügbar seit Ende Q2 2015 Expanded Visibility Log collection from AWS Event Source Monitoring Integrated visibility into Web and mobile applications via WTD Enhanced Investigations Enhanced Reconstruction Streamlined Workflow Investigate restored compliance data Expanded SIEM Capabilities Hierarchical Alerting (Beta) Improved Alert tuning options Incident & Alert Workflow Platform Maturity Health & Wellness Data Privacy Alerting Audit Logging Centralized Role Context sensitive Based Permissions help Packaging & GTM Trust-based licensing model Use Case Packaging & Subscriptions 3 rd Party Storage Options This roadmap documents contains forward looking statements and are plans, not commitments 24
SOC-Organisationen und Skaleneffekte Tier 1 Analyst Tier 2 Analyst Analysis & Tools Support Analyst Threat Intelligence Analyst SOC Manager 25
Driver: Secure Access Driver: Achieve Compliance Multi-factor Auth Single-Sign On Federation Via Access Entitlements Via Governance Roles Policies Fulfillment Certifications Governance Reviews Authorization Request Via Lifecycle Collections Copyright 2015 EMC Corporation. Confidential and Proprietary. NDA Required 26
EMC, RSA, the EMC logo and the RSA logo are trademarks of EMC Corporation in the U.S. and other countries.