Taming the logs Vocabularies for semantic security analysis
|
|
|
- Elisabeth Short
- 5 years ago
- Views:
Transcription
1 Taming the logs Vocabularies for semantic security analysis Elmar Kiesling Andreas Ekelhart, Kabul Kurniawan This work was sponsored by the Austrian Science Fund (FWF) and netidee SCIENCE under grant P30437-N31, as well as the COMET K1 program by the Austrian Research Promotion Agency.
2 Just last week
3 Motivation Security Challenges: Increasingly sophisticated attacks Indicators of compromise hidden in high-volume log data Difficult to connect disparate clues in scattered, heterogeneous logs State-of-the-art approaches: SIEM systems: log aggregation, (often rudimentary) correlation, alerting Intrusion detection/prevention (IDS/IPS) systems usually based on statistical models or signatures Not particularly good at: interpreting potential clues putting them into context establishing causal links between them automatically detecting unseen attacks Consequences Tedious manual analyses Lack of situational awareness False positives Alert fatigue Long detection and response times when incidents do occur
4 The good news.. Systems generate vast amounts of log data.... and there are tools to collect it.
5 The bad news.. Firewall- Log Syntactic heterogeneity Semantic heterogeneity Windows Event log Linux Authlog? Inconsistent identifiers Linux Syslog Logs are weakly structured, use varying formats, and inconsistent terminology Interpretation is difficult, requires background knowledge, and is highly context-dependent Connecting clues from disparate, heterogeneous logs is hard There is just too much of it for human experts to analyze
6 Semantics to the rescue.. Characteristics of semantic technologies: Graph-based Explicit Semantics Decentralization Standards-based flexible schemas flexible querying context-rich representation terminological clarity machine-readability integration reasoning alignment reconciliation linking federation sharing SPARQL RDF JSON-LD Semantic foundation for security analytics (monitoring, threat intelligence and detection, forensics, incident response etc.)
7 Semantic security log analysis: Architecture
8 Vocabulary design Log level: Core vocabulary: basic logging concepts Source-specific extensions Largely literal representation for efficient transformation Use existing vocabularies where directly possible Event level: Enriched and extracted events 1..n log entries single log event Vocabularies security and process knowledge High-level event level events from multiple sources patterns of related events + System vocabularies + Threat pattern vocabularies..
9 Log Vocabularies Log Vocabularies Syslog Win Event log Apache log IIS log SQL Server log MySQL log.. CoreLog
10 Log Extraction Design goals: Preliminary harmonization, uniform representation Initial lifting for many sources in a scalable manner Large-scale, high-throughput log processing (near) real-time extraction Support for stream processing Extension points for subsequent enrichment, alignment, entity reconciliation and linking with background knowledge Approach: Independent extraction for each log source Add semantics to raw JSON stream through injection Add nodes for subsequent linking (e.g., anonymous assets)
11 Example: Extracted log message (JSON-LD) Apr 9 09:37:47 kabul-virtualbox systemd[1]: Mounted Huge Pages File System. { } "@context":" "logmessage":"apr 9 09:37:47 kabul VirtualBox systemd [1]: Mounted Huge Pages File System.", "timestamp":" T07:37:47.000Z", "hasprocessid":"1", "hasseverity":{ "severityname":"notice", "severitycode":"5" }, "@type":" "haslogtype":" "@id":" ca1c f 432d befd abca46258e85", "hasprogram":{ "programname":"systemd" }, "logfilepath":"/var/log/syslog", "hasfacility":{ "facilitycode":"1", "facilityname":"user level" }, "input":{ "type":"log" }, "originatesfrom":{ "hostname":"kabul VirtualBox" } { "@context": { "rdfs": " "xsd": " "syslog": " "scl": " } } "logfilepath": { "@id": "scl:logfilepath", "@type": "rdfs:literal" }, "timestamp": { "@id":"scl:timestamp", "@type": "xsd:datetime" }, "logmessage": { "@id":"scl:logmessage", "@type": "rdfs:literal" },
12 Background Knowledge System knowledge: Capture organization-specific concepts, assets, policies.. e.g., users, network components etc. Event knowledge: Event definitions and associated extraction patterns Threat knowledge: Threat intelligence (indicators of compromise, common attack patterns,..) Challenges: Knowledge evolves dynamically e.g., IPs, devices, projects etc. Historic context is important! System Syslog Events Apache Events Background : xsd: < :bg0a894ed5-746c-4f3e-90e5-efc22cdbcca9 a cl:host, cl:hostname "kabul-virtualbox"^^xsd:string ; cl:ipaddress " "^^xsd:String ; sys_bg:hosttype "DatabaseServer"^^xsd:String. :bg93f2287a-07e b-990f37a26db9 a cl:host, cl:hostname "linux-machine"^^xsd:string ; cl:ipaddress " "^^xsd:String ; sys_bg:hosttype "WebServer"^^xsd:String. :bg93f2287a-07e b-990f37a26db9 a cl:host, cl:hostname "DESKTOP-MAC610T"^^xsd:String ; cl:ipaddress " "^^xsd:String ; sys_bg:hosttype "FileServer"^^xsd:String. Example system background knowledge..
13 Linking to Background Knowledge <LinkageRule linktype="owl:sameas"> <Compare id="levenshteindistance1" required="false"weight="1" metric="levenshteindistance" threshold="0.0" indexing="true"> <TransformInput id="lowercase1" function="lowercase"> <Input id="sourcepath1" path="/syslog:hostname"/> </TransformInput> <TransformInput id="lowercase2" function="lowercase"> <Input id="targetpath1" path="/bgk:hostname"/> </TransformInput> <Paramname="minChar" value="0"/><paramname="maxchar" value="z"/> </Compare> </LinkageRule> Declarative Linking Patterns (Silk) Linking predicate: sameas Example linking rule to establish equivalency based on host name Challenges: Inconsistent identifiers (e.g., IP, host name) entity reconciliation Unstable identifiers (e.g., DHCP leases, PIDs) temporal reasoning (?) Linking target may not exist in BGK discovery mechanism
14 Example: Linking to Background Knowledge
15 Prototype Implementation Web Server Apache Syslog DB Server Syslog Log files Log files JSON LD SPARQL Endpoint Virtual machine with Apache web server (syslog and Apache log) Log acquisition: filebeat Custom Logstash configuration to produce JSON-LD log entries
16 Example Query and Results [Q1] All log messages in a particular time window PREFIX owl: < PREFIX xsd: < PREFIX scl: < PREFIX sysbg: < SELECT?time?logType?hostName?ipAddress?hostType?message WHERE {?logentry a scl:logentry; scl:originatesfrom?host; scl:haslogtype?logtype; scl:logmessage?message; scl:timestamp?time.?host sysbg:hosttype?hosttype; scl:hostname?hostname; scl:ipaddress?ipaddress. FILTER(?time > " T07:29:00+00:00"^^xsd:dateTime &&?time < " T07:34:00+00:00"^^xsd:dateTime)}
17 Example: reconciliation with external threat intelligence CVE: Common Vulnerabilities and Exposures Semi-structured public vulnerabilities list published by MITRE XML-based Attributes: CVE-ID Date, Description, References, Common Platform Enumeration Vulnerable software and versions CVE-PDE mapping available cpe:2.3:a:notepad_plus_plus:notepad\+\+:7.3.3:*:*:*:*:*:*:* Query example: Match CVEs to affected assets based on background knowledge Link to relevant log stream..
18 Example Query with background knowledge [Q2] Vulnerability information from CVE linked to affected server PREFIX cve_ex: < PREFIX win: < PREFIX rdfs:< schema#> PREFIX cve: < SELECT?host?programName?programVersion?CVE?CVEDesc WHERE {?logentry a win:windowshighlevelevent ; win:sourcehost?host ; win:programname?programname ; cve:hasvulnerability?cve.?cve cve:cvedesc?cvedesc ; cve:programversion?programversion }
19 Conclusions Semantic security logs create a foundation for tools that could.. improve situational awareness facilitate better security decision-making create better understanding enable faster forensics make more effective incident response and containment possible What we have accomplished so far.. Architecture Domain-specific Vocabularies Log acquisition and knowledge extraction Alignment and entity reconciliation Linking to background knowledge Prototype
20 Current/Future Work Log domains Scalable storage and query federation Linked data and LDF querying interfaces Process mining Threat intelligence sharing Event linking RDF Stream processing
21 Q&A?
National Cyber Security Operations Center (N-CSOC) Stakeholders' Conference
National Cyber Security Operations Center (N-CSOC) Stakeholders' Conference Benefits to the Stakeholders A Collaborative and Win-Win Strategy Lal Dias Chief Executive Officer Sri Lanka CERT CC Cyber attacks
NOTHING IS WHAT IT SIEMs: COVER PAGE. Simpler Way to Effective Threat Management TEMPLATE. Dan Pitman Principal Security Architect
NOTHING IS WHAT IT SIEMs: COVER PAGE Simpler Way to Effective Threat Management TEMPLATE Dan Pitman Principal Security Architect Cybersecurity is harder than it should be 2 SIEM can be harder than it should
SIEM: Five Requirements that Solve the Bigger Business Issues
SIEM: Five Requirements that Solve the Bigger Business Issues After more than a decade functioning in production environments, security information and event management (SIEM) solutions are now considered
COMPUTER AND INFORMATION SCIENCE JENA DB. Group Abhishek Kumar Harshvardhan Singh Abhisek Mohanty Suhas Tumkur Chandrashekhara
JENA DB Group - 10 Abhishek Kumar Harshvardhan Singh Abhisek Mohanty Suhas Tumkur Chandrashekhara OUTLINE Introduction Data Model Query Language Implementation Features Applications Introduction Open Source
ISO27001 Preparing your business with Snare
WHITEPAPER Complying with ISO27001 Preparing your business with Snare T he technical controls imposed by ISO (International Organisation for Standardization) Standard 27001 cover a wide range of security
ARC VIEW. Critical Industries Need Continuous ICS Security Monitoring. Keywords. Summary. By Sid Snitkin
ARC VIEW FEBRUARY 1, 2018 Critical Industries Need Continuous ICS Security Monitoring By Sid Snitkin Keywords Anomaly and Breach Detection, Continuous ICS Security Monitoring, Nozomi Networks Summary Most
The GenCyber Program. By Chris Ralph
The GenCyber Program By Chris Ralph The Mission of GenCyber Provide a cybersecurity camp experience for students and teachers at the K-12 level. The primary goal of the program is to increase interest
A multi-objective decision support framework for simulation-based security control selection
A multi-objective decision support framework for simulation-based security control selection Elmar Kiesling, Christine Strauß, Christian Stummer Andreas Ekelhart, Stefan Fenz, Bernhard Grill Fourth International
ISO/IEC Solution Brief ISO/IEC EventTracker 8815 Centre Park Drive, Columbia MD 21045
Solution Brief 8815 Centre Park Drive, Columbia MD 21045 About delivers business critical software and services that transform high-volume cryptic log data into actionable, prioritized intelligence that
CYBER ANALYTICS. Architecture Overview. Technical Brief. May 2016 novetta.com 2016, Novetta
CYBER ANALYTICS Architecture Overview Technical Brief May 2016 novetta.com 2016, Novetta Novetta Cyber Analytics: Technical Architecture Overview 1 INTRODUCTION 2 CAPTURE AND PROCESS ALL NETWORK TRAFFIC
Securing Production Applications & Data at Runtime. Prevoty
Securing Production Applications & Data at Runtime Prevoty Introducing Prevoty Scalable visibility and protection for all applications and services 20+ 3 Over Verticals: Awards & Recognitions Years in
SOLUTION BRIEF RSA NETWITNESS SUITE 3X THE IMPACT WITH YOUR EXISTING SECURITY TEAM
SOLUTION BRIEF RSA NETWITNESS SUITE 3X THE IMPACT WITH YOUR EXISTING SECURITY TEAM OVERVIEW The Verizon 2016 Data Breach Investigations Report highlights that attackers are regularly outpacing the defenders.
Automated Response in Cyber Security SOC with Actionable Threat Intelligence
Automated Response in Cyber Security SOC with Actionable Threat Intelligence while its biggest weakness is lack of visibility: SOCs still can t detect previously unknown threats, which is a consistent
Integrated, Intelligence driven Cyber Threat Hunting
Integrated, Intelligence driven Cyber Threat Hunting THREAT INVESTIGATION AND RESPONSE PLATFORM Zsolt Kocsis IBM Security Technical Executive, CEE zsolt.kocsis@hu.ibm.com 6th Nov 2018 Build an integrated
Cyber Defense Maturity Scorecard DEFINING CYBERSECURITY MATURITY ACROSS KEY DOMAINS
Cyber Defense Maturity Scorecard DEFINING CYBERSECURITY MATURITY ACROSS KEY DOMAINS Cyber Defense Maturity Scorecard DEFINING CYBERSECURITY MATURITY ACROSS KEY DOMAINS Continual disclosed and reported
Analytics Driven, Simple, Accurate and Actionable Cyber Security Solution CYBER ANALYTICS
Analytics Driven, Simple, Accurate and Actionable Cyber Security Solution CYBER ANALYTICS Overview Cyberattacks are increasingly getting more frequent, more sophisticated and more widespread than ever
Opus: University of Bath Online Publication Store
Patel, M. (2004) Semantic Interoperability in Digital Library Systems. In: WP5 Forum Workshop: Semantic Interoperability in Digital Library Systems, DELOS Network of Excellence in Digital Libraries, 2004-09-16-2004-09-16,
Unlocking the Power of the Cloud
TRANSFORM YOUR BUSINESS With Smarter IT Unlocking the Power of the Cloud Hybrid Networking Managed Security Cloud Communications Software-defined solutions that adapt to the shape of your business The
Trustwave Managed Security Testing
Trustwave Managed Security Testing SOLUTION OVERVIEW Trustwave Managed Security Testing (MST) gives you visibility and insight into vulnerabilities and security weaknesses that need to be addressed to
A Knowledge-based Alert Evaluation and Security Decision Support Framework 1
A Knowledge-based Alert Evaluation and Security Decision Support Framework 1 Jinqiao Yu Department of Mathematics and Computer Science Illinois Wesleyan Univerisity P.O.Box 2900 Bloomington, IL 61701 Ramana
SIEM Solutions from McAfee
SIEM Solutions from McAfee Monitor. Prioritize. Investigate. Respond. Today s security information and event management (SIEM) solutions need to be able to identify and defend against attacks within an
CYBER ANALYTICS. An Advanced Network- Traffic Analytics Solution
CYBER ANALYTICS An Advanced Network- Traffic Analytics Solution Dramatically increase the efficiency and effectiveness of IT security staff and threat responders by providing them with the right information
Semantic Information Retrieval: An Ontology and RDFbased
Semantic Information Retrieval: An Ontology and RDFbased Model S. Mahaboob Hussain Assistant Professor, CSE Prathyusha Kanakam Assistant Professor, CSE D. Suryanarayana Professor, CSE Swathi Gunnam PG
White Paper. Why IDS Can t Adequately Protect Your IoT Devices
White Paper Why IDS Can t Adequately Protect Your IoT Devices Introduction As a key component in information technology security, Intrusion Detection Systems (IDS) monitor networks for suspicious activity
CYBER RISK MANAGEMENT: ADDRESSING THE CHALLENGE SIMON CRUMPLIN, FOUNDER & CEO
CYBER RISK MANAGEMENT: ADDRESSING THE CHALLENGE SIMON CRUMPLIN, FOUNDER & CEO INFORMATION SECURITY PAINS CISO RESPONSIBILITY WITHOUT AUTHORITY INVENTORY TO MANAGE ALERTS WITHOUT MEANING ASSETS SPREAD ACROSS
Detection and Analysis of Threats to the Energy Sector (DATES)
Detection and Analysis of Threats to the Energy Sector (DATES) Sponsored by the Department of Energy National SCADA Test Bed Program Managed by the National Energy Technology Laboratory The views herein
NEXT GENERATION SECURITY OPERATIONS CENTER
DTS SOLUTION NEXT GENERATION SECURITY OPERATIONS CENTER SOC 2.0 - ENHANCED SECURITY O&M SOC 2.0 - SUCCESS FACTORS SOC 2.0 - FUNCTIONAL COMPONENTS DTS SOLUTION SOC 2.0 - ENHANCED SECURITY O&M SOC 2.0 Protecting
Agenda. Why we need a new approach to endpoint security. Introducing Sophos Intercept X. Demonstration / Feature Walk Through. Deployment Options
Agenda Why we need a new approach to endpoint security Introducing Sophos Intercept X Demonstration / Feature Walk Through Deployment Options Q & A 2 Endpoint Security has reached a Tipping Point Attacks
Semantic Web Fundamentals
Semantic Web Fundamentals Web Technologies (706.704) 3SSt VU WS 2018/19 with acknowledgements to P. Höfler, V. Pammer, W. Kienreich ISDS, TU Graz January 7 th 2019 Overview What is Semantic Web? Technology
ALIENVAULT USM FOR AWS SOLUTION GUIDE
ALIENVAULT USM FOR AWS SOLUTION GUIDE Summary AlienVault Unified Security Management (USM) for AWS is a unified security platform providing threat detection, incident response, and compliance management
WHY SIEMS WITH ADVANCED NETWORK- TRAFFIC ANALYTICS IS A POWERFUL COMBINATION. A Novetta Cyber Analytics Brief
WHY SIEMS WITH ADVANCED NETWORK- TRAFFIC ANALYTICS IS A POWERFUL COMBINATION A Novetta Cyber Analytics Brief Why SIEMs with advanced network-traffic analytics is a powerful combination. INTRODUCTION Novetta
Symantec Security Monitoring Services
24x7 real-time security monitoring and protection Protect corporate assets from malicious global threat activity before it impacts your network. Partnering with Symantec skilled and experienced analysts
Deception: Deceiving the Attackers Step by Step
Deception: Deceiving the Attackers Step by Step TrapX Security, Inc. February, 2018 In 2017, Gartner emphasized how companies are transforming their security spending strategy and moving away from prevention-only
Threat Containment and Operations. Yong Kwang Kek, Director of Presales SE, APJ
Threat Containment and Operations Yong Kwang Kek, Director of Presales SE, APJ 2018-07-19 1 1 2017 Infoblox Inc. All Rights 2013 Infoblox Inc. All Reserved. Rights Reserved. Three Aspects of Security #1
The Model-Driven Semantic Web Emerging Standards & Technologies
The Model-Driven Semantic Web Emerging Standards & Technologies Elisa Kendall Sandpiper Software March 24, 2005 1 Model Driven Architecture (MDA ) Insulates business applications from technology evolution,
RSA INCIDENT RESPONSE SERVICES
RSA INCIDENT RESPONSE SERVICES Enabling early detection and rapid response EXECUTIVE SUMMARY Technical forensic analysis services RSA Incident Response services are for organizations that need rapid access
RT-204: Systemic Security and the Role of Hierarchical Design in Cyber-Physical Systems
RT-204: Systemic Security and the Role of Hierarchical Design in Cyber-Physical Systems Sponsor: DASD(SE) By Dr. Valerie B. Sitterle Mr. Tom McDermott 10 th Annual SERC Sponsor Research Review November
This shows a typical architecture that enterprises use to secure their networks: The network is divided into a number of segments Firewalls restrict
1 This shows a typical architecture that enterprises use to secure their networks: The network is divided into a number of segments Firewalls restrict access between segments This creates a layered defense
Novetta Cyber Analytics
Know your network. Arm your analysts. Introduction Novetta Cyber Analytics is an advanced network traffic analytics solution that empowers analysts with comprehensive, near real time cyber security visibility
THE RSA SUITE NETWITNESS REINVENT YOUR SIEM. Presented by: Walter Abeson
THE RSA NETWITNESS SUITE REINVENT YOUR SIEM Presented by: Walter Abeson 1 Reality Goals GOALS VERSUS REALITY OF SIEM 1.0 Single compliance & security interface Analyze & prioritize alerts across various
CTI Capability Maturity Model Marco Lourenco
1 CTI Capability Maturity Model Cyber Threat Intelligence Course NIS Summer School 2018, Crete October 2018 MARCO LOURENCO - ENISA Cyber Security Analyst Lead European Union Agency for Network and Information
Grid Resources Search Engine based on Ontology
based on Ontology 12 E-mail: emiao_beyond@163.com Yang Li 3 E-mail: miipl606@163.com Weiguang Xu E-mail: miipl606@163.com Jiabao Wang E-mail: miipl606@163.com Lei Song E-mail: songlei@nudt.edu.cn Jiang
RSA INCIDENT RESPONSE SERVICES
RSA INCIDENT RESPONSE SERVICES Enabling early detection and rapid response EXECUTIVE SUMMARY Technical forensic analysis services RSA Incident Response services are for organizations that need rapid access
THREAT INTEL AND CONTENT CURATION: ORGANIZING THE PATH TO SUCCESSFUL DETECTION
SESSION ID: AIR-W12 THREAT INTEL AND CONTENT CURATION: ORGANIZING THE PATH TO SUCCESSFUL DETECTION Justin Monti CTO MKACyber Mischel Kwon CEO MKACyber @MKACyber What is Cyber Threat Intelligence Data collected,
Context-Aware Analytics in MOM Applications
Context-Aware Analytics in MOM Applications Martin Ringsquandl, Steffen Lamparter, and Raffaello Lepratti Corporate Technology Siemens AG Munich, Germany martin.ringsquandl.ext@siemens.com arxiv:1412.7968v1
SIEMLESS THREAT MANAGEMENT
SOLUTION BRIEF: SIEMLESS THREAT MANAGEMENT SECURITY AND COMPLIANCE COVERAGE FOR APPLICATIONS IN ANY ENVIRONMENT Evolving threats, expanding compliance risks, and resource constraints require a new approach.
APPLYING KNOWLEDGE BASED AI TO MODERN DATA MANAGEMENT. Mani Keeran, CFA Gi Kim, CFA Preeti Sharma
APPLYING KNOWLEDGE BASED AI TO MODERN DATA MANAGEMENT Mani Keeran, CFA Gi Kim, CFA Preeti Sharma 2 What we are going to discuss During last two decades, majority of information assets have been digitized
The Future of Threat Prevention
The Future of Threat Prevention Bricata is the leading developer of Next Generation Intrusion Prevention Systems (NGIPS) technology, providing innovative, disruptive, high-speed, high-performance network
A Risk Management Platform
A Risk Management Platform Michael Lai CISSP, CISA, MBA, MSc, BEng(hons) Territory Manager & Senior Security Sales Engineer Shift to Risk-Based Security OLD MODEL: Prevention-Based Security Prevention
OSSIM Fast Guide
----------------- OSSIM Fast Guide ----------------- February 8, 2004 Julio Casal http://www.ossim.net WHAT IS OSSIM? In three phrases: - VERIFICATION may be OSSIM s most valuable contribution
Mapping Relational Data to RDF with Virtuoso's RDF Views
Mapping Relational Data to RDF with Virtuoso's RDF Views Among its many talents, OpenLink Virtuoso Universal Server includes SPARQL support and an RDF data store tightly integrated with its relational
Automated Visualization Support for Linked Research Data
Automated Visualization Support for Linked Research Data Belgin Mutlu 1, Patrick Hoefler 1, Vedran Sabol 1, Gerwald Tschinkel 1, and Michael Granitzer 2 1 Know-Center, Graz, Austria 2 University of Passau,
Building Resilience in a Digital Enterprise
Building Resilience in a Digital Enterprise Top five steps to help reduce the risk of advanced targeted attacks To be successful in business today, an enterprise must operate securely in the cyberdomain.
RSA NetWitness Suite Respond in Minutes, Not Months
RSA NetWitness Suite Respond in Minutes, Not Months Overview One can hardly pick up a newspaper or turn on the news without hearing about the latest security breaches. The Verizon 2015 Data Breach Investigations
Streamline AWS Security Incidents
IMF 2018 Streamline AWS Security Incidents Asif Matadar @d1r4c #whoami Director of Endpoint Detection & Response (EDR), EMEA at Tanium Seasoned Incident Response professional with over 7 years experience
Fidelis Overview. ISC 2 DoD and Industry Forum. Rapid Detection and Automated Incident Response DoD & Commercial Active Defense Use Cases
Fidelis Overview ISC 2 DoD and Industry Forum Rapid Detection and Automated Incident Response DoD & Commercial Active Defense Use Cases Vince Holtmann-Cyber Subject Matter Expert Vincent.Holtmann@fidelissecurity.com
10 KEY WAYS THE FINANCIAL SERVICES INDUSTRY CAN COMBAT CYBER THREATS
10 KEY WAYS THE FINANCIAL SERVICES INDUSTRY CAN COMBAT CYBER THREATS WHITE PAPER INTRODUCTION BANKS ARE A COMMON TARGET FOR CYBER CRIMINALS AND OVER THE LAST YEAR, FIREEYE HAS BEEN HELPING CUSTOMERS RESPOND
First Look Showcase. Expanding our prevention, detection and response solutions. Marco Rottigni Chief Technical Security Officer, Qualys, Inc.
18 QUALYS SECURITY CONFERENCE 2018 First Look Showcase Expanding our prevention, detection and response solutions Marco Rottigni Chief Technical Security Officer, Qualys, Inc. Secure Enterprise Mobility
SOC-2 Requirement Solution Brief. EventTracker 8815 Centre Park Drive, Columbia MD SOC-2
Requirement Solution Brief 8815 Centre Park Drive, Columbia MD 21045 About delivers business critical software and services that transform high-volume cryptic log data into actionable, prioritized intelligence
Using Ontologies for Data and Semantic Integration
Using Ontologies for Data and Semantic Integration Monica Crubézy Stanford Medical Informatics, Stanford University ~~ November 4, 2003 Ontologies Conceptualize a domain of discourse, an area of expertise
Behavioral Analytics A Closer Look
SESSION ID: GPS2-F03 Behavioral Analytics A Closer Look Mike Huckaby VP, Global Systems Engineering RSA The world is full of obvious things which nobody by any chance ever observes. Sherlock Holmes 2 Patterns
Colin Gibbens Director, Product Management
SOAR = Human Intelligence and Creativity at Speed of Machine Abhishek Narula EVP, Head of Product and Engineering Colin Gibbens Director, Product Management 1 2 What is Security Orchestration Why do I
Semantic Cyberthreat Modelling
Semantic Cyberthreat Modelling Siri Bromander mnemonic siri@mnemonic.no Audun Jøsang University of Oslo josang@ifi.uio.no Martin Eian mnemonic meian@mnemonic.no Abstract Cybersecurity is a complex and
First Look Showcase. Expanding our prevention, detection and response solutions. Sumedh Thakar Chief Product Officer, Qualys, Inc.
18 QUALYS SECURITY CONFERENCE 2018 First Look Showcase Expanding our prevention, detection and response solutions Sumedh Thakar Chief Product Officer, Qualys, Inc. Secure Enterprise Mobility Identity (X.509,
An overview of RDB2RDF techniques and tools
An overview of RDB2RDF techniques and tools DERI Reading Group Presentation Nuno Lopes August 26, 2009 Main purpose of RDB2RDF WG... standardize a language for mapping Relational Database schemas into
Contents. G52IWS: The Semantic Web. The Semantic Web. Semantic web elements. Semantic Web technologies. Semantic Web Services
Contents G52IWS: The Semantic Web Chris Greenhalgh 2007-11-10 Introduction to the Semantic Web Semantic Web technologies Overview RDF OWL Semantic Web Services Concluding comments 1 See Developing Semantic
Presentation by Brett Meyer
Presentation by Brett Meyer Traditional AV Software Problem 1: Signature generation Signature based detection model Sheer volume of new threats limits number of signatures created by one vendor Not good
Semantic Potential of existing Security Advisory Standards
Semantic Potential of existing Security Advisory Standards Secure Business Austria Challenges Well maintained and audited IT infrastructure is critical for ensuring business continuity Ever-growing complexity
CA Security Management
CA Security CA Security CA Security In today s business environment, security remains one of the most pressing IT concerns. Most organizations are struggling to protect an increasing amount of disparate
Security
Security +617 3222 2555 info@citec.com.au Security With enhanced intruder technologies, increasingly sophisticated attacks and advancing threats, your data has never been more susceptible to breaches from
Simplify, Streamline and Empower Security with ISecOps
Simplify, Streamline and Empower Security with ISecOps Matthew O Brien Senior Global Product Manager Cybersecurity DXC.technology 1 What is Integrated Security Operations (ISecOps)? Intelligence Driven,
Technology Risk Management in Banking Industry. Rocky Cheng General Manager, Information Technology, Bank of China (Hong Kong) Limited
Technology Risk Management in Banking Industry Rocky Cheng General Manager, Information Technology, Bank of China (Hong Kong) Limited Change in Threat Landscape 2 Problem & Threats faced by Banking Industry
Noam Ikar R&DVP. Complex Event Processing and Situational Awareness in the Digital Age
Noam Ikar R&DVP Complex Event Processing and Situational Awareness in the Digital Age We need to correlate events from inside and outside the organization by a smart layer Cyberint CEO, Dec 2017. Wikipedia
Communication Pattern Anomaly Detection in Process Control Systems
Communication Pattern Anomaly Detection in Process Control Systems Sponsored by the Department of Energy National SCADA Test Bed Program Managed by the National Energy Technology Laboratory The views herein
Data Sources for Cyber Security Research
Data Sources for Cyber Security Research Melissa Turcotte mturcotte@lanl.gov Advanced Research in Cyber Systems, Los Alamos National Laboratory 14 June 2018 Background Advanced Research in Cyber Systems,
Database of historical places, persons, and lemmas
Database of historical places, persons, and lemmas Natalia Korchagina Outline 1. Introduction 1.1 Swiss Law Sources Foundation as a Digital Humanities project 1.2 Data to be stored 1.3 Final goal: how
Readiness, Response & Resilence:
Readiness, Response & Resilence: building out advance security operations Husam Al Saraf Solutions Principal Lead Turkey, Africa & Middle East #RSAemeaSummit 1 Traditional Security Operations Top Gaps
How AlienVault ICS SIEM Supports Compliance with CFATS
How AlienVault ICS SIEM Supports Compliance with CFATS (Chemical Facility Anti-Terrorism Standards) The U.S. Department of Homeland Security has released an interim rule that imposes comprehensive federal
Annabel Lee Enriquez Project Manager Getty Conservation Institute
Annabel Lee Enriquez Project Manager Getty Conservation Institute aenriquez@getty.edu Outline Project History Inventories Conservation Science: DISCO Arches Version 4 Demo Arches Designer Arches Reference
Linked Data: What Now? Maine Library Association 2017
Linked Data: What Now? Maine Library Association 2017 Linked Data What is Linked Data Linked Data refers to a set of best practices for publishing and connecting structured data on the Web. URIs - Uniform
Transforming Data from into DataPile RDF Structure into RDF
Transforming Data from DataPile Structure Transforming Data from into DataPile RDF Structure into RDF Jiří Jiří Dokulil Charles Faculty of University, Mathematics Faculty and Physics, of Mathematics Charles
Security Operations & Analytics Services
Security Operations & Analytics Services www.ecominfotech.biz info@ecominfotech.biz Page 1 Key Challenges Average time to detect an attack (Dwell time) hovers around 175 to 210 days as reported by some
A Linked Data Translation Approach to Semantic Interoperability
A Data Translation Approach to Semantic Interoperability November 12, 2014 Dataversity Webinar Rafael M Richards MD MS Physician Informaticist Veterans Health Administratioan U.S. Department of Veterans
Perimeter Defenses T R U E N E T W O R K S E C U R I T Y DEPENDS ON MORE THAN
T R U E N E T W O R K S E C U R I T Y DEPENDS ON MORE THAN Perimeter Defenses Enterprises need to take their security strategy beyond stacking up layers of perimeter defenses to building up predictive
Sensor Data Management
Wright State University CORE Scholar Kno.e.sis Publications The Ohio Center of Excellence in Knowledge- Enabled Computing (Kno.e.sis) 8-14-2007 Sensor Data Management Cory Andrew Henson Wright State University
Empower stakeholders with single-pane visibility and insights Enrich firewall security data
SonicWall Analytics Transforming data into information, information into knowledge, knowledge into decisions and decisions into actions SonicWall Analytics provides an eagle-eye view into everything that
Panelists. Moderator: Dr. John H. Saunders, MITRE Corporation
SCADA/IOT Panel This panel will focus on innovative & emerging solutions and remaining challenges in the cybersecurity of industrial control systems ICS/SCADA. Representatives from government and infrastructure
The SANS Institute Top 20 Critical Security Controls. Compliance Guide
The SANS Institute Top 20 Critical Security Controls Compliance Guide February 2014 The Need for a Risk-Based Approach A common factor across many recent security breaches is that the targeted enterprise
Incorporating Network Flows in Intrusion Incident Handling and Analysis
Regional Visualization and Analytics Center Incorporating Network Flows in Intrusion Incident Handling and Analysis John Gerth Stanford University gerth@stanford.edu FloCon 2008 1 EE/CS Network Infrastructure
CCNA Cybersecurity Operations 1.1 Scope and Sequence
CCNA Cybersecurity Operations 1.1 Scope and Sequence Last updated June 18, 2018 Introduction Today's organizations are challenged with rapidly detecting cybersecurity breaches and effectively responding
OpenBudgets.eu: Fighting Corruption with Fiscal Transparency. Project Number: Start Date of Project: Duration: 30 months
OpenBudgets.eu: Fighting Corruption with Fiscal Transparency Project Number: 645833 Start Date of Project: 01.05.2015 Duration: 30 months Deliverable 4.1 Specification of services' Interfaces Dissemination
Orchestrating Music Queries via the Semantic Web
Orchestrating Music Queries via the Semantic Web Milos Vukicevic, John Galletly American University in Bulgaria Blagoevgrad 2700 Bulgaria +359 73 888 466 milossmi@gmail.com, jgalletly@aubg.bg Abstract
New Generation SIEM. Solution Development
New Generation SIEM Solution Development Big Picture of Solution Actions Flow NewGen SIEM Agents Events/Artifacts Data Flow vciso Indicator of Compromise Сollector Solution/Service Title Indicator of Compromise
WHITE PAPER. Operationalizing Threat Intelligence Data: The Problems of Relevance and Scale
WHITE PAPER Operationalizing Threat Intelligence Data: The Problems of Relevance and Scale Operationalizing Threat Intelligence Data: The Problems of Relevance and Scale One key number that is generally
Multi-agent and Semantic Web Systems: RDF Data Structures
Multi-agent and Semantic Web Systems: RDF Data Structures Fiona McNeill School of Informatics 31st January 2013 Fiona McNeill Multi-agent Semantic Web Systems: RDF Data Structures 31st January 2013 0/25
Key Technologies for Security Operations. Copyright 2014 EMC Corporation. All rights reserved.
Key Technologies for Security Operations 2 Traditional Security Is Not Working 97% of breaches led to compromise within days or less with 72% leading to data exfiltration in the same time Source: Verizon
INCIDENTRESPONSE.COM. Automate Response. Did you know? Your playbook overview - Unauthorized Access
Automate Response Congratulations on selecting IncidentResponse.com to retrieve your custom incident response playbook guide. This guide has been created especially for you for use in within your security
Optimising a Semantic IoT Data Hub
Optimising a Semantic IoT Data Hub Ilias Tachmazidis, Sotiris Batsakis, John Davies, Alistair Duke, Grigoris Antoniou and Sandra Stincic Clarke John Davies, BT Overview Motivation de-siloization and data
High Availability Configuration Guide
High Availability Configuration Guide Table of Contents PURPOSE OF THE DOCUMENT 3 ABOUT EVENTLOG ANALYZER 3 WHY IT IS NECESSARY TO ENSURE HIGH AVAILABILITY OF EVENTLOG ANALYZER? 3 WORKING OF HIGH AVAILABILITY
Ontological Decision-Making for Disaster Response Operation Planning
Ontological Decision-Making for Disaster Response Operation Planning Abstract Disaster response operation planners could benefit from a software tool to assist them in extracting individual mission information