Examining the Evolution of CERT Operations. Managed Incident Program Prevention & Response. The Methodology of INTEL
|
|
|
- Juniper Glenn
- 5 years ago
- Views:
Transcription
1 The Methodology of ETC Managed Incident Program Prevention & Response ASSC RAAT CSC [MIPR]: Plan INTEL Examining the Evolution of CERT Operations RADAR by Robert J. Bagnall Director of Intelligence Operations idefense, Inc. PS-PT
![Contents The CERT Today Current CERT Architecture Significant Existing Issues The Missing Links: Unplugged Security Leaks [the SODATA ] End-user Awareness, Policy, &](/docs-images/91/104495186/images/2-0.jpg "Enforcement [Automated] Correlation & Corroboration Correlation Out-of-Band Intelligence, not simply information Behavioral Modeling Other Factors The Complete IR Operations")
2 Contents The CERT Today Current CERT Architecture Significant Existing Issues The Missing Links: Unplugged Security Leaks [the SODATA ] End-user Awareness, Policy, & Enforcement [Automated] Correlation & Corroboration Correlation Out-of-Band Intelligence, not simply information Behavioral Modeling Other Factors The Complete IR Operations Process
3 Contents Steps to Achieving the Goal of True Security Visualization Essentials of the MIPR Process The 7 Steps of Effective Incident Response MIPR Stages of Event Escalation The Incident Criticality Chart The Event Impact Scale The MIPR Delta of Event Handling New CERT Architecture & Operations with MIPR New CERT Operations Process with MIPR The MIPR IR Wizard & Other Analyst Support Interfaces
4 CERT Operations Architecture Today CERT Operations Architecture Today DNS FW IDS WEB FILE SVR SYSLOG }In-Band Sensors SYSLOG EXTERNAL INFORMATION RESOURCES CERT / IR Ops
5 The CERT Today Significant Existing Issues: 1. Extremely Poor Event Visualization 2. Limited Metrics Compilation 3. No Behavioral Modeling 4. No Correlation-Out-of-Band 5. Lack of Interoperability [COTS] 6. No Standardized Content Delivery 7. Personnel Experience Must Make Up Gaps
6 7 Offensive Data Aggregation Techniques for Attacks: The SODATA Unnecessary Information Leaks [UILs] Data Disposal Policy & Enforcement [D2] Bandwidth & Data Flow [B&D] Organizational Behaviors [OBs] Terminated Access Controls Enforcement [TACE] New Systems Identification & Discovery [NSID] Configuration Management & Maintenance [CMM]
7 End-user Awareness, Policy, & Enforcement STOP IGNORING END-USER AWARENESS! End-user awareness = greater security End-user awareness = end-user accountability Accountability = legal protection for the corporation Accountability is not possible without a comprehensive, yet digestible corporate security and acceptable use policy Enforcement, like other information gathering, should be 75% automated and 25% human oversight
8 [Automated] Correlation & Corroboration Let the technology do what it does best Incorporate behavior Match it against history Eliminate what you know and what you can predict and that will leave you with what you don t know Infuse information & refine it into intelligence
9 Correlation Out-of-Band Merge biometric, access card, and other physical access data with cyber-security infrastructure Gather accessibility information on all portable devices and secure each individually Compare user & group access information versus realtime access data on critical servers
10 Intelligence, Not Information Intelligence, Not Information Effective Intelligence requires both human and automated resources to discern actionable intelligence from available data by utilizing network information correlated with open source reporting and corroborated by a fundamental understanding of historic enterprise behavior, organizational presence in the worldat-large, and outsider threats. Enterprise Operational Data Behavioral Modeling All-source Information Understanding of the Brand Knowledge of Opponents }= Efficient, Timely Decision Making Know Your Enemy, Know Yourself, and Win the Day
11 Behavioral Modeling Behavioral Modeling Behavioral Modeling is second only to an established end-user awareness program in both importance and how frequently it is overlooked by organizations. Behavioral Modeling consists of: 1> monitoring daily enterprise use and function 2> establishing strong, easily understood corporate acceptable use policy 3> writing policy enforcement agents to crawl the system 4> shutting off unnecessary ports, services, shells, etc. 5> establishing a database of enterprise architecture functionality 4> linking policy to agents to alert on violations 5> linking sensor alerts to system behaviors & system behaviors to agent alerts 6> educating enterprise end-users on cyber-security awareness 7> linking agents to training & certification tracking as well as violations by users
12 21 Pieces to A Complete IR Operations Process MSS Monitoring Intelligence Correlation Out-of-Band Correlation Behavioral Modeling Config Management & Maint. Corroboration Scans, Risk Assessments, IV+V Malware Defense Historical Analysis Threat Impact Ratings Atypical/ Asymmetrical Defenses Profiling Con Plan & Disaster Recovery Visualization Health & Welfare Metrics Prevention Analysis & Assessment Reporting Training
13 The MIPR Methodology The MIPR Methodology ASSC CSC ETC Program INTEL RAAT Plan RADAR PS-PT
14 The 7 Steps of Incident Prevention & Response 1. Data Collection [from the user to the enterprise level] 2. Intelligence Integration [profiling & all-source reporting from external forces] 3. Behavioral Infusion [from system to user to attacker to nation state] 4. Collation Analysis [What does all the data tell us? What is the Ņbig pictureó?] 5. Resultant Action [What do we do about it?] 6. Conclusive Reporting [Here is what we did about it Š plays into behavioral infusion in the future] 7. Operations Review [What do we fix/adjust [if anything]?]
15 Stages of Escalation Stages of Escalation Stages of Escalation CASE (Based upon single or multiple incidents) INCIDENT (Based upon multiple events) EVENT (Based upon multiple Instances or Occurrences) INDICATOR
16 Defined Incident Criticality Defined Incident Criticality Incident Criticality definitions are stated here to provide a basic template for understanding the level of threat an individualincident poses to the target enterprise. Where ICs are already predefined by the customer [ie: DoD-CERT], the MIPR adopts the customer process. Incident Criticality Definition Critical Incident has a significant negative impact on security posture or continuous enterprise operations and requires immediate action. Suspicious Incident poses a threat to the security posture or continuous operation of the enterprise and requires investigation. Notable Incident exhibits anomalous behavior and requires analysis to determine its legitimacy.
17 Event Impact Scale Event Impact Scale Event Impact Scale IRRELEVANT KNOWN UNKNOWN KNOWN PREPARED FOR PREPARED FOR NOT PREPARED FOR ŅPain ThresholdÓ UNKNOWN NOT PREPARED FOR
18 Manage The MIPR Wheel of Event Handling Resolve Plan Train 4 3 Detect Prevent
19 { In-Band Sensors CERT Operations with MIPR FW IDS WEB DNS FILE SVR SYSLOG SYSLOG Config Mgmt & Maint Internal Web Data Enterprise Architecture SDAT Sensors Access Controls}Out-of-Band Correlation/Corroboration Behavioral Modeling Real Time Filtering Agents/Bots/Lookups Operations Core [Last 90 Days]
20 CERT Operations with MIPR CERT Operations with MIPR Correlation/Corroboration Behavioral Modeling Enterprise Metrics Optional Data B/U Feed for Historical Analysis Real Time Filtering Agents/Bots/Lookups Correlated Data Push to CERT Wizard Interface Enterprise Reporting Operations Core [Last 90 Days] Enterprise Core History [Last 3 Years] (optional) CERT Internal Web Ad Hoc Current & Historical Analysis CERT / IR Ops
21 CERT Operations Process with MIPR INDICATOR Trigger of some sensor, in-band, out-of-band,etc. Indicator Preprocessing Phase 1 Correlation & Corroboration A> Information Gathering B> Historical Behavioral Analysis * SDAT * NetCraft * NIC Lookups Metrics & Reporting Phase 2 Correlation & Corroboration A> Behavioral Modeling B> Policy Enforcement * Recently deemed acceptable/not * New admin acct setups after hours * Acceptable use violations Behavioral Modeling & Policy Enforcement Alert Processor CERT Internal Web Data Push to 5-Step CIWI Wizard A> Level 1 Analysis B> Incident Handler Analysts C> Case decisions & escalation made here based upon human oversight Level 2 Case Investigations A> Security Engineers Investigate B> Step thru as follows: * Manage & Mitigate * Implement Updates & Fixes * Close & Resolve CERT Analysis Level 1 CERT Analysis Level 2 Collected Intelligence Feed
22 The MIPR IR Wizard & Other Interfaces The IR Wizard Interface Steps analysts thru incident management your way Pushes data, reducing response times Correlates & corroborates automatically [where practical] Auto-generates metrics & reporting The End-user Dashboard Policy Enforcement & Training Alerts, news items, & corporate announcements One-stop shop of pushed intelligence & controlled media Pop-up violation reminders Agent & Security Administration/Reporting Agent scheduling, creation, evolution, & management Metrics collation Operational reporting
23 Conclusion The MIPR means: Incident prevention & management, not reaction Understanding your own environment first as well as facing the threats that face your enterprise ETC Accepting atypical expenses & resource requirements to achieve real Program security success ASSC RAAT Automate those things that technology does well CSC Plan Utilize human potential where INTEL it it most effective Establish comprehensive, easily understood, repeatable processes Creating, training, automating, and enforcing acceptable use policy Exploring alternative technologies and home-grown issue-specific solutions RADAR PS-PT Acknowledging non-cyber factors which affect cyber ops and flexing to degrade their impact Constantly evolving the cyber-defense operations process
24 Questions??
RANGER: Incident Management & CERT Operations Methodology
RANGER: Incident Management & CERT Operations Methodology CONTINUITY & FORENSICS ASSESSMENT & POLICY INTEL EDUCATION & AWARENESS OPERATIONAL INSTRUCTIONS, BEHAVIORAL ANALYSIS & METRICS, AND METHODS ENVIRONMENT
National Cyber Security Operations Center (N-CSOC) Stakeholders' Conference
National Cyber Security Operations Center (N-CSOC) Stakeholders' Conference Benefits to the Stakeholders A Collaborative and Win-Win Strategy Lal Dias Chief Executive Officer Sri Lanka CERT CC Cyber attacks
locuz.com SOC Services
locuz.com SOC Services 1 Locuz IT Security Lifecycle services combine people, processes and technologies to provide secure access to business applications, over any network and from any device. Our security
Supercharge Your SIEM: How Domain Intelligence Enhances Situational Awareness
Supercharge Your SIEM: How Domain Intelligence Enhances Situational Awareness Introduction Drowning in data but starving for information. It s a sentiment that resonates with most security analysts. For
A Practical Guide to Efficient Security Response
A Practical Guide to Efficient Security Response The Essential Checklist Start The Critical Challenges to Information Security Data breaches constantly threaten the modern enterprise. And the risk continues
ForeScout Extended Module for Splunk
Enterprise Strategy Group Getting to the bigger truth. ESG Lab Review ForeScout Extended Module for Splunk Date: May 2017 Author: Tony Palmer, Senior Lab Analyst Abstract This report provides a first look
भ रत य ररज़र व ब क. Setting up and Operationalising Cyber Security Operation Centre (C-SOC)
Annex-2 Setting up and Operationalising Cyber Security Operation Centre (C-SOC) Introduction 1 - Banking Industry in India has evolved technologically over the years and currently delivering innovative
TEL2813/IS2820 Security Management
TEL2813/IS2820 Security Management Security Management Models And Practices Lecture 6 Jan 27, 2005 Introduction To create or maintain a secure environment 1. Design working security plan 2. Implement management
THE SIX ESSENTIAL CAPABILITIES OF AN ANALYTICS-DRIVEN SIEM
THE SIX ESSENTIAL CAPABILITIES OF AN ANALYTICS-DRIVEN SIEM Modern threats demand analytics-driven security and continuous monitoring Legacy SIEMs are Stuck in the Past Finding a mechanism to collect, store
Emerging Issues: Cybersecurity. Directors College 2015
Emerging Issues: Cybersecurity Directors College 2015 Agenda/Objectives Define Cybersecurity Cyber Fraud Trends/Incidents FFIEC Cybersecurity awareness initiatives Community Bank expectations FFIEC Cybersecurity
SOLUTION BRIEF RSA ARCHER IT & SECURITY RISK MANAGEMENT
RSA ARCHER IT & SECURITY RISK MANAGEMENT INTRODUCTION Organizations battle growing security challenges by building layer upon layer of defenses: firewalls, antivirus, intrusion prevention systems, intrusion
How Boards use the NIST Cybersecurity Framework as a Roadmap to oversee cybersecurity
How Boards use the NIST Cybersecurity Framework as a Roadmap to oversee cybersecurity Why is the NIST framework important? GOH Seow Hiong Executive Director, Global Policy & Government Affairs, Asia Pacific
Carbon Black PCI Compliance Mapping Checklist
Carbon Black PCI Compliance Mapping Checklist The following table identifies selected PCI 3.0 requirements, the test definition per the PCI validation plan and how Carbon Black Enterprise Protection and
Security Monitoring Engineer / (NY or NC) Director, Information Security. New York, NY or Winston-Salem, NC. Location:
Position: Reports to: Location: Security Monitoring Engineer / (NY or NC) Director, Information Security New York, NY or Winston-Salem, NC Position Summary: The Clearing House (TCH) Information Security
CERT Development EFFECTIVE RESPONSE
CERT Development EFFECTIVE RESPONSE CERT Development: EFFECTIVE RESPONSE 2 Effective Response Effective Response Well funded, organized attackers threaten your network IT attacks can result in: Loss of
BUILDING CYBERSECURITY CAPABILITY, MATURITY, RESILIENCE
BUILDING CYBERSECURITY CAPABILITY, MATURITY, RESILIENCE 1 WHAT IS YOUR SITUATION? Excel spreadsheets Manually intensive Too many competing priorities Lack of effective reporting Too many consultants Not
RSA IT Security Risk Management
RSA IT Security Risk Adding Insight to Security March 18, 2014 Wael Jaroudi GRC Sales Specialist 1 Where is Security Today? Companies have built layer upon layer of security, but is it helping? Complexity
The Resilient Incident Response Platform
The Resilient Incident Response Platform Accelerate Your Response with the Industry s Most Advanced, Battle-Tested Platform for Incident Response Orchestration The Resilient Incident Response Platform
Essentials to creating your own Security Posture using Splunk Enterprise
Essentials to creating your own Security Posture using Splunk Enterprise Using Splunk to maximize the efficiency and effectiveness of the SOC / IR Richard W. McKee, MS-ISA, CISSP Principal Cyber Security
RFP/RFI Questions for Managed Security Services. Sample MSSP RFP Template
RFP/RFI Questions for Managed Security Services Sample MSSP RFP Template Table of Contents Request for Proposal Template Overview 1 Introduction... 1 How to Use this Document... 1 Suggested RFP Outline
RSA INCIDENT RESPONSE SERVICES
RSA INCIDENT RESPONSE SERVICES Enabling early detection and rapid response EXECUTIVE SUMMARY Technical forensic analysis services RSA Incident Response services are for organizations that need rapid access
Managed Endpoint Defense
DATA SHEET Managed Endpoint Defense Powered by CB Defense Next-gen endpoint threat detection and response DEPLOY AND HARDEN. Rapidly deploy and optimize endpoint prevention with dedicated security experts
RSA INCIDENT RESPONSE SERVICES
RSA INCIDENT RESPONSE SERVICES Enabling early detection and rapid response EXECUTIVE SUMMARY Technical forensic analysis services RSA Incident Response services are for organizations that need rapid access
INFORMATION ASSURANCE DIRECTORATE
National Security Agency/Central Security Service INFORMATION ASSURANCE DIRECTORATE CGS Network Mapping The Network Mapping helps visualize the network and understand relationships and connectivity between
May 14, :30PM to 2:30PM CST. In Plain English: Cybersecurity and IT Exam Expectations
May 14, 2018 1:30PM to 2:30PM CST In Plain English: Cybersecurity and IT Exam Expectations Options to Join Webinar and audio Click on the link: https://www.webcaster4.com/webcast/page/584/24606 Choose
RELEVANT IMPACT: Building a Successful Threat Management Program. NTX ISSA 3 rd Semi-Annual Cyber Security Conference
RELEVANT IMPACT: Building a Successful Threat Management Program NTX ISSA 3 rd Semi-Annual Cyber Security Conference 10-2-15 Threat Management Definition Current State of Threat Management in Most Organizations
McAfee Endpoint Threat Defense and Response Family
Defense and Family Detect zero-day malware, secure patient-zero, and combat advanced attacks The escalating sophistication of cyberthreats requires a new generation of protection for endpoints. Advancing
ICBA Summary of FFIEC Cybersecurity Assessment Tool (May 2017 Update)
ICBA Summary of FFIEC Cybersecurity Assessment Tool (May 2017 Update) June 2017 INSERT YEAR HERE Contact Information: Jeremy Dalpiaz AVP, Cyber and Data Security Policy Jeremy.Dalpiaz@icba.org ICBA Summary
How AlienVault ICS SIEM Supports Compliance with CFATS
How AlienVault ICS SIEM Supports Compliance with CFATS (Chemical Facility Anti-Terrorism Standards) The U.S. Department of Homeland Security has released an interim rule that imposes comprehensive federal
Device Discovery for Vulnerability Assessment: Automating the Handoff
Device Discovery for Vulnerability Assessment: Automating the Handoff O V E R V I E W While vulnerability assessment tools are widely believed to be very mature and approaching commodity status, they are
Security Management Models And Practices Feb 5, 2008
TEL2813/IS2820 Security Management Security Management Models And Practices Feb 5, 2008 Objectives Overview basic standards and best practices Overview of ISO 17799 Overview of NIST SP documents related
Automating the Top 20 CIS Critical Security Controls
20 Automating the Top 20 CIS Critical Security Controls SUMMARY It s not easy being today s CISO or CIO. With the advent of cloud computing, Shadow IT, and mobility, the risk surface area for enterprises
Reducing the Cost of Incident Response
Reducing the Cost of Incident Response Introduction Cb Response is the most complete endpoint detection and response solution available to security teams who want a single platform for hunting threats,
WITH ACTIVEWATCH EXPERT BACKED, DETECTION AND THREAT RESPONSE BENEFITS HOW THREAT MANAGER WORKS SOLUTION OVERVIEW:
SOLUTION OVERVIEW: ALERT LOGIC THREAT MANAGER WITH ACTIVEWATCH EXPERT BACKED, DETECTION AND THREAT RESPONSE Protecting your business assets and sensitive data requires regular vulnerability assessment,
RSA NetWitness Suite Respond in Minutes, Not Months
RSA NetWitness Suite Respond in Minutes, Not Months Overview One can hardly pick up a newspaper or turn on the news without hearing about the latest security breaches. The Verizon 2015 Data Breach Investigations
The Convergence of Security and Compliance. How Next Generation Endpoint Security Manages 5 Core Compliance Controls
The Convergence of Security and Compliance How Next Generation Endpoint Security Manages 5 Core Compliance Controls Table of Contents Introduction.... 3 Positive versus Negative Application Security....
Discover threats quickly, remediate immediately, and mitigate the impact of malware and breaches
Discover threats quickly, remediate immediately, and mitigate the impact of malware and breaches Introduction No matter how hard you work to educate your employees about the constant and evolving threats
WHITE PAPER. Operationalizing Threat Intelligence Data: The Problems of Relevance and Scale
WHITE PAPER Operationalizing Threat Intelligence Data: The Problems of Relevance and Scale Operationalizing Threat Intelligence Data: The Problems of Relevance and Scale One key number that is generally
NERC CIP VERSION 6 BACKGROUND COMPLIANCE HIGHLIGHTS
NERC CIP VERSION 6 COMPLIANCE BACKGROUND The North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) Reliability Standards define a comprehensive set of requirements
Cyber Defense Maturity Scorecard DEFINING CYBERSECURITY MATURITY ACROSS KEY DOMAINS
Cyber Defense Maturity Scorecard DEFINING CYBERSECURITY MATURITY ACROSS KEY DOMAINS Cyber Defense Maturity Scorecard DEFINING CYBERSECURITY MATURITY ACROSS KEY DOMAINS Continual disclosed and reported
CYBERBIT P r o t e c t i n g a n e w D i m e n s i o n
CYBERBIT P r o t e c t i n g a n e w D i m e n s i o n CYBETBIT in a Nutshell A leader in the development and integration of Cyber Security Solutions A main provider of Cyber Security solutions for the
Best Practices in ICS Security for System Operators
Best Practices in ICS Security for System Operators Introduction Industrial automation and control systems have become increasingly connected to internal and external networks. This exposure has resulted
The SANS Institute Top 20 Critical Security Controls. Compliance Guide
The SANS Institute Top 20 Critical Security Controls Compliance Guide February 2014 The Need for a Risk-Based Approach A common factor across many recent security breaches is that the targeted enterprise
ACM Retreat - Today s Topics:
ACM Retreat - Today s Topics: Phase II Cyber Risk Management Services - What s next? Policy Development External Vulnerability Assessment Phishing Assessment Security Awareness Notification Third Party
FFIEC Cyber Security Assessment Tool. Overview and Key Considerations
FFIEC Cyber Security Assessment Tool Overview and Key Considerations Overview of FFIEC Cybersecurity Assessment Tool Agenda Overview of assessment tool Review inherent risk profile categories Review domain
Continuous protection to reduce risk and maintain production availability
Industry Services Continuous protection to reduce risk and maintain production availability Managed Security Service Answers for industry. Managing your industrial cyber security risk requires world-leading
Cybersecurity Risk Mitigation: Protect Your Member Data. Introduction
Cybersecurity Risk Mitigation: Protect Your Member Data Presented by Matt Mitchell, CISSP Knowledge Consulting Group Introduction Matt Mitchell- Director Risk Assurance 17 years information security experience
Integrated, Intelligence driven Cyber Threat Hunting
Integrated, Intelligence driven Cyber Threat Hunting THREAT INVESTIGATION AND RESPONSE PLATFORM Zsolt Kocsis IBM Security Technical Executive, CEE zsolt.kocsis@hu.ibm.com 6th Nov 2018 Build an integrated
Make IR Effective with Risk Evaluation and Reporting
SESSION ID: AIR-R02 Make IR Effective with Risk Evaluation and Reporting Mischel Kwon President/CEO MKA Cyber @mkacyber Justin Monti Sr. VP Security Engineering MKA Cyber You ve Got an Incident Now What?
01.0 Policy Responsibilities and Oversight
Number 1.0 Policy Owner Information Security and Technology Policy Policy Responsibility & Oversight Effective 01/01/2014 Last Revision 12/30/2013 Department of Innovation and Technology 1. Policy Responsibilities
Design your network to aid forensics investigation
18th Annual FIRST Conference Design your network to aid forensics investigation Robert B. Sisk, PhD, CISSP Senior Technical Staff Member IBM Baltimore, Maryland USA Master Outline Introduction Incident
Designing and Building a Cybersecurity Program
Designing and Building a Cybersecurity Program Based on the NIST Cybersecurity Framework (CSF) Larry Wilson lwilson@umassp.edu ISACA Breakfast Meeting January, 2016 Designing & Building a Cybersecurity
The Convergence of Security and Compliance
ebook The Convergence of Security and Compliance How Next Generation Endpoint Security Manages 5 Core Compliance Controls Table of Contents Introduction....3 Positive versus Negative Application Security....3
Introducing Cyber Observer
"Organizations are failing at early breach detection, with more than 92% of breaches undetected by the breached organization. The situation can be improved with stronger threat intelligence, the addition
Aligning with the Critical Security Controls to Achieve Quick Security Wins
Aligning with the Critical Security Controls to Achieve Quick Security Wins Background The Council on CyberSecurity s Critical Security Controls for Effective Cyber Defense provide guidance on easy wins
Education Network Security
Education Network Security RECOMMENDATIONS CHECKLIST Learn INSTITUTE Education Network Security Recommendations Checklist This checklist is designed to assist in a quick review of your K-12 district or
Designing an Adaptive Defense Security Architecture. George Chiorescu FireEye
Designing an Adaptive Defense Security Architecture George Chiorescu FireEye Designing an Adaptive Security Architecture Key Challanges Existing blocking and prevention capabilities are insufficient to
EC-Council Certified Network Defender (CND) Duration: 5 Days Method: Instructor-Led
EC-Council Certified Network Defender (CND) Duration: 5 Days Method: Instructor-Led Certification: Certified Network Defender Exam: 312-38 Course Description This course is a vendor-neutral, hands-on,
DEFINITIONS AND REFERENCES
DEFINITIONS AND REFERENCES Definitions: Insider. Cleared contractor personnel with authorized access to any Government or contractor resource, including personnel, facilities, information, equipment, networks,
Deep Instinct v2.1 Extension for QRadar
Deep Instinct v2.1 Extension for QRadar This scalable joint solution enables the seamless ingestion of Deep Instinct events into IBM QRadar platform, this results in higher visibility of security breaches
Why you should adopt the NIST Cybersecurity Framework
Why you should adopt the NIST Cybersecurity Framework It s important to note that the Framework casts the discussion of cybersecurity in the vocabulary of risk management Stating it in terms Executive
Balancing Compliance and Operational Security Demands. Nov 2015 Steve Winterfeld
Balancing Compliance and Operational Security Demands Nov 2015 Steve Winterfeld What is more important? Compliance with laws / regulations Following industry best practices Developing a operational practice
Transforming Security Part 2: From the Device to the Data Center
SESSION ID: SP01-R11 Transforming Security Part 2: From the Device to the Data Center John Britton Director, EUC Security VMware @RandomDevice The datacenter as a hospital 3 4 5 Digital transformation
Certified Information Security Manager (CISM) Course Overview
Certified Information Security Manager (CISM) Course Overview This course teaches students about information security governance, information risk management, information security program development,
Managed Security Services - Automated Analysis, Threat Analyst Monitoring and Notification
Service Description Managed Security Services - Automated Analysis, Threat Analyst Monitoring and Notification The services described herein are governed by the terms and conditions of the agreement specified
Building Resilience in a Digital Enterprise
Building Resilience in a Digital Enterprise Top five steps to help reduce the risk of advanced targeted attacks To be successful in business today, an enterprise must operate securely in the cyberdomain.
Key Technologies for Security Operations. Copyright 2014 EMC Corporation. All rights reserved.
Key Technologies for Security Operations 2 Traditional Security Is Not Working 97% of breaches led to compromise within days or less with 72% leading to data exfiltration in the same time Source: Verizon
Enterprise Situational Intelligence
DATA SHEET Enterprise Situational Intelligence You can attain a real-time, authoritative view of your network infrastructure using Lumeta ESI. Running in an always-on mode, ESI delivers network indexing,
Cyber Security Technologies
1 / Cyber Security Technologies International Seminar on Cyber Security: An Action to Establish the National Cyber Security Center Lisbon, 12 th September 2013 23 / Key highlights - Thales Group Thales
White Paper. Closing PCI DSS Security Gaps with Proactive Endpoint Monitoring and Protection
White Paper Closing PCI DSS Security Gaps with Proactive Endpoint Monitoring and Protection Table of Contents Introduction....3 Positive versus Negative Application Security....3 Continuous Audit and Assessment
Pedal to the Metal: Mitigating New Threats Faster with Rapid Intel and Automation
Pedal to the Metal: Mitigating New Threats Faster with Rapid Intel and Automation Date: November 14, 2016 Underwritten by: Introduction Agencies deal with a greater volume and velocity of cyber threats
Course Outline Topic 1: Current State Assessment, Security Operations Centers, and Security Architecture
About this Course This course will best position your organization to analyse threats and detect anomalies that could indicate cybercriminal behaviour. The payoff for this new proactive approach would
INTEGRATION BRIEF DFLabs and Jira: Streamline Incident Management and Issue Tracking.
INTEGRATION BRIEF DFLabs and Jira: Streamline Incident Management and Issue Tracking. Integrate IncMan SOAR s Orchestration, Automation and Response capabilities with your existing Jira solution. Solution
ISO/IEC Solution Brief ISO/IEC EventTracker 8815 Centre Park Drive, Columbia MD 21045
Solution Brief 8815 Centre Park Drive, Columbia MD 21045 About delivers business critical software and services that transform high-volume cryptic log data into actionable, prioritized intelligence that
Digital Forensics Readiness PREPARE BEFORE AN INCIDENT HAPPENS
Digital Forensics Readiness PREPARE BEFORE AN INCIDENT HAPPENS Digital Forensics Readiness: PREPARE BEFORE AN INCIDENT HAPPENS 2 Digital Forensics Readiness The idea that all networks can be compromised
ArcSight Activate Framework
ArcSight Activate Framework Petropoulos #HPProtect 44% Have trouble managing their SIEM eiqnetworks 2013 SIEM Survey #1 challenge Identification of key events SANS 2012 Log Management and Event Management
Sustainable Security Operations
Sustainable Security Operations Optimize processes and tools to make the most of your team s time and talent The number and types of security incidents organizations face daily are steadily increasing,
10 Cybersecurity Questions for Bank CEOs and the Board of Directors
4 th Annual UBA Bank Executive Winter Conference February, 2015 10 Cybersecurity Questions for Bank CEOs and the Board of Directors Dr. Kevin Streff Founder, Secure Banking Solutions 1 Board of Directors
NERC CIP: Fundamental Security Requirements of an Electronic Access Control and Monitoring System (EACMS) Requirements Mapping to ConsoleWorks
NERC CIP: Fundamental Security Requirements of an Electronic Access Control and Monitoring System (EACMS) Requirements Mapping to ConsoleWorks NERC Standard Requirement Requirement Text Measures ConsoleWorks
INFORMATION ASSURANCE DIRECTORATE
National Security Agency/Central Security Service INFORMATION ASSURANCE DIRECTORATE CGS Host Intrusion The Host Intrusion employs a response to a perceived incident of interference on a host-based system
Risk: Security s New Compliance. Torsten George VP Worldwide Marketing and Products, Agiliance Professional Strategies - S23
Risk: Security s New Compliance Torsten George VP Worldwide Marketing and Products, Agiliance Professional Strategies - S23 Agenda Market Dynamics Organizational Challenges Risk: Security s New Compliance
INFORMATION ASSURANCE DIRECTORATE
National Security Agency/Central Security Service INFORMATION ASSURANCE DIRECTORATE CGS Signature Repository A Signature Repository provides a group of signatures for use by network security tools such
EXPERT SERVICES FOR IoT CYBERSECURITY AND RISK MANAGEMENT. An Insight Cyber White Paper. Copyright Insight Cyber All rights reserved.
EXPERT SERVICES FOR IoT CYBERSECURITY AND RISK MANAGEMENT An Insight Cyber White Paper Copyright Insight Cyber 2018. All rights reserved. The Need for Expert Monitoring Digitization and external connectivity
SIEMLESS THREAT DETECTION FOR AWS
SOLUTION OVERVIEW: ALERT LOGIC FOR AMAZON WEB SERVICES (AWS) SIEMLESS THREAT DETECTION FOR AWS Few things are as important to your business as maintaining the security of your sensitive data. Protecting
Stephanie Zierten Associate Counsel Federal Reserve Bank of Boston
Stephanie Zierten Associate Counsel Federal Reserve Bank of Boston Cybersecurity Landscape Major Data Breaches (e.g., OPM, IRS) Data Breach Notification Laws Directors Derivative Suits Federal Legislation
Novetta Cyber Analytics
Know your network. Arm your analysts. Introduction Novetta Cyber Analytics is an advanced network traffic analytics solution that empowers analysts with comprehensive, near real time cyber security visibility
Reinvent Your 2013 Security Management Strategy
Reinvent Your 2013 Security Management Strategy Laurent Boutet 18 septembre 2013 Phone:+33 6 25 34 12 01 Email:laurent.boutet@skyboxsecurity.com www.skyboxsecurity.com What are Your Key Objectives for
Not your Father s SIEM
Not your Father s SIEM Getting Better Insights & Results Bill Thorn Director, Security Operations Apollo Education Group Agenda Why use a SIEM? What is a SIEM? Benefits of Using a SIEM Considerations Before
GDPR: An Opportunity to Transform Your Security Operations
GDPR: An Opportunity to Transform Your Security Operations McAfee SIEM solutions improve breach detection and response Is your security operations GDPR ready? General Data Protection Regulation (GDPR)
Cyber security tips and self-assessment for business
Cyber security tips and self-assessment for business Last year one in five New Zealand SMEs experienced a cyber-attack, so it s essential to be prepared. Our friends at Deloitte have put together this
Security+ SY0-501 Study Guide Table of Contents
Security+ SY0-501 Study Guide Table of Contents Course Introduction Table of Contents About This Course About CompTIA Certifications Module 1 / Threats, Attacks, and Vulnerabilities Module 1 / Unit 1 Indicators
Security Information & Event Management (SIEM)
Security Information & Event Management (SIEM) Datasheet SIEM in a nutshell The variety of cyber-attacks is extraordinarily large. Phishing, DDoS attacks in combination with ransomware demanding bitcoins
Protecting Against Modern Attacks. Protection Against Modern Attack Vectors
Protecting Against Modern Attacks Protection Against Modern Attack Vectors CYBER SECURITY IS A CEO ISSUE. - M C K I N S E Y $4.0M 81% >300K 87% is the average cost of a data breach per incident. of breaches
Vulnerability Assessments and Penetration Testing
CYBERSECURITY Vulnerability Assessments and Penetration Testing A guide to understanding vulnerability assessments and penetration tests. OVERVIEW When organizations begin developing a strategy to analyze
ARC VIEW. Critical Industries Need Continuous ICS Security Monitoring. Keywords. Summary. By Sid Snitkin
ARC VIEW FEBRUARY 1, 2018 Critical Industries Need Continuous ICS Security Monitoring By Sid Snitkin Keywords Anomaly and Breach Detection, Continuous ICS Security Monitoring, Nozomi Networks Summary Most
CERT Overview. Jeffrey J. Carpenter 2008 Carnegie Mellon University
CERT Overview Jeffrey J. Carpenter 2008 Carnegie Mellon University Software Engineering Institute Department of Defense R&D Laboratory FFRDC Created in 1984 Administered by Carnegie Mellon
ADAPTIVE MONITORING AND DETECTION FOR TODAYS LANDSCAPE
ADAPTIVE MONITORING AND DETECTION FOR TODAYS LANDSCAPE BIO CISO at Binary Defense Systems 15+ years experience, specializing in security operations, threat intelligence, and incident response Created SOC
Criminal Justice Information Security (CJIS) Guide for ShareBase in the Hyland Cloud
Criminal Justice Information Security (CJIS) Guide for ShareBase in the Hyland Cloud Introduction The Criminal Justice Information Security (CJIS) Policy is a publically accessible document that contains
Security by Default: Enabling Transformation Through Cyber Resilience
Security by Default: Enabling Transformation Through Cyber Resilience FIVE Steps TO Better Security Hygiene Solution Guide Introduction Government is undergoing a transformation. The global economic condition,
BPS Suite and the OCEG Capability Model. Mapping the OCEG Capability Model to the BPS Suite s product capability.
BPS Suite and the OCEG Capability Model Mapping the OCEG Capability Model to the BPS Suite s product capability. BPS Contents Introduction... 2 GRC activities... 2 BPS and the Capability Model for GRC...