Real-time DDoS Defense: A collaborative Approach at Internet Scale
|
|
|
- Emmeline Johns
- 6 years ago
- Views:
Transcription
1 Real-time DDoS Defense: A collaborative Approach at Internet Scale
2 Agenda Problem & Goal Insight Overview Challenges Implementation Evaluation Conclusion Discussion 2
3 Problem & Goal
4 Problem Source: 4
5 Problem networktraffic 5
6 Problem mitigation and reaction 6
7 Goal 7 Source:
8 Ingredients Insight Overview Evaluation Challenges Implementation Source: 8
9 Insight RQ1: Is real-time and automatic mitigation at ISP level performed and if yes, how? 9
10 Insight Online November December 2012 May July Source:
11 Real-time and automatic mitigation North America 2% Asia 5% Origin 35,00% 30,00% Market segment and frequency 25,00% 20,00% 15,00% 10,00% 5,00% 0,00% Europe 93% February 2015 Jessica Steinberger: Give and Take - Mitigation and Response: A collaborative approach
12 Real-time and automatic mitigation Process and involved third-parties ISPs and CSIRTs to aid NOC by or telephone February 2015 Jessica Steinberger: Give and Take - Mitigation and Response: A collaborative approach
13 Real-time and automatic mitigation February 2015 Jessica Steinberger: Give and Take - Mitigation and Response: A collaborative approach
14 Real-time and automatic mitigation February 2015 Jessica Steinberger: Give and Take - Mitigation and Response: A collaborative approach
15 Real-time and automatic mitigation Use of automatic mitigation and response tools Plan of use of automatic mitigation and response tools Unsure 3% Agree 43% Unsure 3% 31% Yes 37% No 60% Disagree 17% Yes 37% No 60% 6% 6% 17% Yes, we are planning to do it No, we will not make use of it We are looking into it I am not aware of it February 2015 Jessica Steinberger: Give and Take - Mitigation and Response: A collaborative approach
16 Real-time and automatic mitigation 16 Automatic actions of mitigation and response tools Rerouting traffic Change blocking / filter capabilities Notification Rate limiting at ingress Exchange data with trusted partners Quarantine machines Changing the target's IP address Other Actions already performed Actions would like to use February 2015 Jessica Steinberger: Give and Take - Mitigation and Response: A collaborative approach
17 Real-time and automatic mitigation IP traffic filtering IP traffic filtering Greylists 18% No 52% Yes 48% Blacklists 53% Whitelists 29% February 2015 Jessica Steinberger: Give and Take - Mitigation and Response: A collaborative approach
18 Real-time and automatic mitigation Network configuration protocols 21 Current technical ability to use OpenFlow / Plan to make use of OpenFlow in 3 years 15 39% 10 6 Yes 29% No 71% 9% 10% 13% Netconf SNMP OpenFlow Other Yes, we are planning to do it No, we will not make use of it We are looking into it I am not aware of it February 2015 Jessica Steinberger: Give and Take - Mitigation and Response: A collaborative approach
19 Real-time and automatic mitigation 18 Sharing threat indicators or security events / incidents None Various CERTs or CSIRTs Law enforcement or governmental entities 0 Industry peers Only receive data Threat indicators Security events/incidents February 2015 Jessica Steinberger: Give and Take - Mitigation and Response: A collaborative approach
20 Real-time and automatic mitigation Collaboration improves mitigation and response capabilities Disagree 4% Exchange protocols / formats Agree 43% Strongly agree 53% SCAP IDXP IDMEF IODEF x-arf Do or did use Know Heard of Unknown February 2015 Jessica Steinberger: Give and Take - Mitigation and Response: A collaborative approach
21 Ingredients Insight Overview Evaluation Challenges Implementation Source: 21
22 Terminology Format Protocol vs. 22 Source:
23 Terminology 23
24 Terminology Alert/ Event Alarm/ Warning Incident Security Event/Incident 24
25 Terminology Event Incident Chance Card vs. Source: Source: 25
26 Application Domain Source: 26
27 Who is involved? US governments Defense Advance Research Projects Agency (DARPA) TERENA IETF Incident Handling Stuttgart University s CERT IETF IDWG MITRE IETF MARF Eco Association of the German Internet Industry 27 Source:
28 Timeline 1997 CISL DARPA 2001 IODEF TERENA 2002 CAIF University Stuttgart CERT 2002 IODEF IETF INCH 2003 FINE IETF INCH 2003 IODEF IETF INCH 2003 IDMEF IETF IDWG 2009 CEE MITRE 2013 Project DMTF Cloud Audit or Project Lumberjack ARF MAAWG 2007 ARF IETF MARF 2012 x-arf Eco-Association of the German Internet Industry 2013 x-xarf Kohlrausch & Übelacker
29 Exchange formats CISL IODEF CAIF IDMEF CEE ARF x-arf/x-xarf syslog Language S-expressions XML XML XML XML, JSON MIME MIME Text/XML Content Events, Attacks, Responses Events, Incidents Problem, Vulnerability, Exposure Alerts, Alive messages Events Spam Incidents, Attacks Producer Machine Human Human Machine Machine Machine Machine Machine Consumer Machine Human Human Machine Human Machine/ Human Machine/Human Events Machine/ Human 29
30 IODEF vs. IDMEF 30
31 ARF vs. x-xarf 31
32 Exchange formats and protocols Protocol OSI layer Format Security CIDF Transport CISL message Symmetric Cryptography RID Application IODEF TLS XEP-0268 Application IODEF TLS IDXP Application IDMEF TLS CLT Transport CEE Provided by syslog (RFC 5425) SMTP Application CAIF ARF x-arf Syslog (RFC 3164) Transport Syslog (RFC 3164) None Syslog (RFC 5425) Transport Syslog (RFC 5424) TLS None S/MIME Multipart/Signed Multipart/Encrypted 32
33 Evaluation results XML MIME 33
34 Ingredients Insight Overview Evaluation Challenges Implementation Source: 34
35 Challenges FP rogue ISPs Source: Quantifying cost/benefit Risk 35 Source:
36 Ingredients Insight Overview Evaluation Challenges Implementation Source: 36
37 Framework 37
38 Mitigation and Response System Inference Engine (PHREAK) Event producer sends consumes publishes Pattern Matcher Agenda delivers subscribes Incident consumer Production Memory (rules) Working Memory (facts) 38
39 Mitigation and Response System Pattern Matcher Event Processing Response Selection Reaction Execution Knowledge Base 39
40 Mitigation and Response System Event Processing Normalization Aggregation / Correlation Event Pattern Frequency of event in a time window Geolocation IP Filtering Lists Confidence 40
41 Mitigation and Response System Response Selection Comparison Prioritation Previous Reactions Potential damage Benefit Risk CVSS Event profiles 41
42 Mitigation and Response System Reaction Execution Notification Configuration Exchange formats Pub/Sub Consumer 42
43 Flow-based Event Exchange Format (FLEX) 43
44 Ingredients Insight Overview Evaluation Challenges Implementation Source: 44
45 Evaluation Methodology Source: 45
46 Ingredients Insight Overview Evaluation Challenges Implementation Source: 46
47 Conclusion insight into processes, structures and capabilities a hands-on for network operators 47
48 Conclusion FLEX framework 48
49 Discussion Source: 49
SURVEY ON NETWORK ATTACK DETECTION AND MITIGATION
SURVEY ON NETWORK ATTACK DETECTION AND MITIGATION Welcome to the da/sec survey on network attack detection and mitigation. Network-based attacks pose a strong threat to the Internet landscape and academia
The State of Standardization Efforts to support Data Exchange in the Security Domain
The State of Standardization Efforts to support Data Exchange in the Security Domain Roman Danyliw FloCon 2004: Standards Talk Network Group Software Engineering Institute Carnegie Mellon
Building Global CSIRT Capabilities
Building Global CSIRT Capabilities Barbara Laswell, Ph.D. September 2003 CERT Centers Software Engineering Institute Carnegie Mellon Pittsburgh, PA 15213 Sponsored by the U.S. Department of Defense 1 2003
Extended INCident Handling Working Group (INCH)
Internet Engineering Task Force Extended INCident Handling Working Group (INCH) http://www.cert.org/ietf/inch/inch_interim_2004.html 12:00 16:00 Sunday, June 13 2004 Interim Meeting Budapest, Hungary Roman
Semantic Potential of existing Security Advisory Standards
Semantic Potential of existing Security Advisory Standards Secure Business Austria Challenges Well maintained and audited IT infrastructure is critical for ensuring business continuity Ever-growing complexity
RID IETF Draft Update
RID IETF Draft Update Kathleen M. Moriarty INCH Working Group 29 March 2005 This work was sponsored by the Air Force under Air Force Contract Number F19628-00-C-0002. "Opinions, interpretations, conclusions,
RID IETF Draft Update
RID IETF Draft Update Kathleen M. Moriarty INCH Working Group 5 August 2004 This work was sponsored by the Air Force under Air Force Contract Number F19628-00-C-0002. "Opinions, interpretations, conclusions,
X-ARF: A Reporting and Exchange Format for the Data Exchange of Netflow and Honeypot Data
X-ARF: A Reporting and Exchange Format for the Data Exchange of Netflow and Honeypot Data Jan Kohlrausch, Sven Übelacker, GÉANT 3 JRA2 T4: Internal deliverable DFN-CERT Services GmbH Hamburg, Germany Email:
CIRT: Requirements and implementation
CIRT: Requirements and implementation By : Muataz Elsadig Sudan CERT Joint ITU-ATU Workshop on Cyber-security Strategy in African Countries Khartoum, Republic of Sudan, 24 26 July 2016 There is no globally
Ian Bryant (VEDEF WG Co-Chair) 26 th May 2006
!" Ian Bryant (VEDEF WG Co-Chair) 26 th May 2006 Summary of Situation Activity Since Last Meeting Discussion Summary of Situation Activity Since Last Meeting Discussion !"# Many TF-CSIRT members are engaged
The SANS Institute Top 20 Critical Security Controls. Compliance Guide
The SANS Institute Top 20 Critical Security Controls Compliance Guide February 2014 The Need for a Risk-Based Approach A common factor across many recent security breaches is that the targeted enterprise
Creating the IETF IDWG Intrusion Detection Protocols IDMEF & IDXP
Creating the IETF IDWG Intrusion Detection Protocols IDMEF & IDXP Ground System Architectures Workshop GSAW 2002 March 12-15, 2002 Joe Betser Andy Walther The Aerospace Corp Mike Erlinger, Tim Buchheim
Denial of Service Protection Standardize Defense or Loose the War
Denial of Service Protection Standardize Defense or Loose the War ETSI : the threats, risk and opportunities 16th and 17th - Sophia-Antipolis, France By: Emir@cw.net Arslanagic Head of Security Engineering
RFC 2350 YOROI-CSDC. Expectations for Computer Security Incident Response. Date 2018/03/26. Version 1.0
RFC 2350 YOROI-CSDC Expectations for Computer Security Incident Response Title RFC 2350 YOROI-CSDC Document Type Specification Date 2018/03/26 Version 1.0 Yoroi S.r.l. Parte del gruppo MAM www.yoroi.company
The Case for National CSIRTs
The Case for National CSIRTs ENOG 12 Yerevan 3-4 Oct 2016 What is a CERT (CSIRT)? A Computer Security Incident Response Team (CSIRT) is a service organization that is responsible for receiving, reviewing,
Statistics Clearinghouse function Infrastructure Alert function
ecsirt.net The European CSIRT Network Status Update TF-CSIRT, September 2003 Amsterdam, NL Review of the current results Statistics Clearinghouse function Infrastructure Alert function Slide 2 Participation
Reducing Cybersecurity Costs & Risk through Automation Technologies
Reducing Cybersecurity Costs & Risk through Automation Technologies Sponsored by Juniper Networks Independently conducted by Ponemon Institute LLC Publication Date: November 2017 Ponemon Institute Research
Panelists. Moderator: Dr. John H. Saunders, MITRE Corporation
SCADA/IOT Panel This panel will focus on innovative & emerging solutions and remaining challenges in the cybersecurity of industrial control systems ICS/SCADA. Representatives from government and infrastructure
Bradford J. Willke. 19 September 2007
A Critical Information Infrastructure Protection Approach to Multinational Cyber Security Events Bradford J. Willke 19 September 2007 Overview A framework for national Critical Information Infrastructure
Cybersecurity Auditing in an Unsecure World
About This Course Cybersecurity Auditing in an Unsecure World Course Description $5.4 million that s the average cost of a data breach to a U.S.-based company. It s no surprise, then, that cybersecurity
Network and Information Security Directive
Network and Information Security Directive Provisions + ENISA s activities Dr Evangelos Ouzounis Head of Secure Infrastructure and Services Unit, ENISA European Union Agency for Network and Information
Delivering Integrated Cyber Defense for the Cloud Generation Darren Thomson
Delivering Integrated Cyber Defense for the Generation Darren Thomson Vice President & CTO, EMEA Region Symantec In 2009 there were 2,361,414 new piece of malware created. In 2015 that number was 430,555,582
Cyber Security Technologies
1 / Cyber Security Technologies International Seminar on Cyber Security: An Action to Establish the National Cyber Security Center Lisbon, 12 th September 2013 23 / Key highlights - Thales Group Thales
O N L I N E I N C I D E N T R E S P O N S E C O M M U N I T Y
Automate Response Congratulations on selecting IncidentResponse.com to retrieve your custom incident response playbook guide. This guide has been created especially for you for use in within your security
ISAO SO Product Outline
Draft Document Request For Comment ISAO SO 2016 v0.2 ISAO Standards Organization Dr. Greg White, Executive Director Rick Lipsey, Deputy Director May 2, 2016 Copyright 2016, ISAO SO (Information Sharing
RFC2350 TLP1: WHITE. Έκδοση National CSIRT-CY RFC2350
Έκδοση 1.2-2018.02.14 TLP1: WHITE 1 TLP Sources may use TLP: WHITE when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release.
Implementing a National Strategy : the case of the Tunisian CERT
Implementing a National Strategy : the case of the Tunisian CERT Belhassen ZOUARI, CEO, National Agency for Computer Security, Head of Cert-Tcc, E-mail : B.Zouari@ansi.tn a fast Historical Overview end
An overview of the CERT/CC and CSIRT Community
An overview of the CERT/CC and CSIRT Community Jason A. Rafail October 2007 2007 Carnegie Mellon University Overview CERT/CC CSIRTs with National Responsibility Partnerships and Trust Training Conclusion
How to manage evolving threats on evolving ICT assets across Enterprise
How to manage evolving threats on evolving ICT assets across Enterprise Marek Skalicky, CISM, CRISC, Qualys MD for CEE November, 2015 Vaš partner za varovanje informacij Agenda Security STARTs with VISIBILITY
INFORMATION ASSURANCE DIRECTORATE
National Security Agency/Central Security Service INFORMATION ASSURANCE DIRECTORATE CGS Host Intrusion The Host Intrusion employs a response to a perceived incident of interference on a host-based system
Directive on Security of Network and Information Systems
European Commission - Fact Sheet Directive on Security of Network and Information Systems Brussels, 6 July 2016 Questions and Answers The European Parliament's plenary adopted today the Directive on Security
Stakeholders Analysis
Stakeholders Analysis Introduction National Stakeholders ISP citizens CNIIP Media National CIRT Academia ONG, Public And Private Institutions sectoral CSIRTs Law enforcement 2 2 CIRT ISP A specialized
TURNING THE TABLE THROUGH FEDERATED INFORMATION SHARING
TURNING THE TABLE THROUGH FEDERATED INFORMATION SHARING Kathleen Moriarty EMC Corporation Patrick Curry British Business Federation Authority (BBFA) Session ID: GRC- W09 Session Classification: Intermediate
Fundamentals of Cybersecurity/CIIP. Building Capacity: Using a National Strategy & Self-Assessment
Fundamentals of Cybersecurity/CIIP Building Capacity: Using a National Strategy & Self- Presented to: 2009 ITU Regional Cybersecurity Forum for Asia-Pacific Connecting the World Responsibly 23-25 25 September
SECURE INFORMATION EXCHANGE: REFERENCE ARCHITECTURE
SECURE INFORMATION EXCHANGE: REFERENCE ARCHITECTURE MAY 2017 A NEXOR WHITE PAPER NEXOR 2017 ALL RIGHTS RESERVED CONTENTS 3 4 5 6 8 9 10 11 12 14 15 16 INTRODUCTION THREATS RISK MITIGATION REFERENCE ARCHITECTURE
Defense-in-Depth Against Malicious Software. Speaker name Title Group Microsoft Corporation
Defense-in-Depth Against Malicious Software Speaker name Title Group Microsoft Corporation Agenda Understanding the Characteristics of Malicious Software Malware Defense-in-Depth Malware Defense for Client
McAfee Advanced Threat Defense
Advanced Threat Defense Detect advanced malware Advanced Threat Defense enables organizations to detect advanced, evasive malware and convert threat information into immediate action and protection. Unlike
GARR-CERT. Update. Simona Venuti TF-CSIRT, Rome,
GARR-CERT Update OLD GARR-CERT Presentation... I do not know who was the first to present GARR-CERT... And I do not have that presentation, nor any presentation at all Since my duty is to make an «update»...
Grid Security Incident Handling and Response Guide
Open Science Grid Open Science Grid Grid Security Incident Handling and Response Guide 20 Nov 2004-1- Version 1.0 Issue Date Comment 0.1 30 Aug 2004 Draft release to the Activity Group 0.2 7 Sept 2004
Notification of Issuance of Binding Operational Directive and Establishment of. AGENCY: National Protection and Programs Directorate, DHS.
This document is scheduled to be published in the Federal Register on 09/19/2017 and available online at https://federalregister.gov/d/2017-19838, and on FDsys.gov 9110-9P-P DEPARTMENT OF HOMELAND SECURITY
Business Context: Key for Successful Risk Management
Business Context: Key for Successful Risk Management Philip Aldrich, CISSP, CISM, CISA, CRISC, CIPP Program Director, Risk Management EMC Event Alert Finding Incident Law Vulnerability Regulation Audit
Cyber Threat Intelligence Standards - A high-level overview
Cyber Threat Intelligence Standards - A high-level overview Christian Doerr TU Delft, Cyber Threat Intelligence Lab Delft University of Technology Challenge the future ~ whoami At TU Delft since 2008 in
GÉANT: A Defense in Depth Approach
GÉANT: A Defense in Depth Approach Wayne Routly Security Manager DANTE SURFcert Utrecht.nl Febuary 2014 Agenda GEANT Network Technology and forward thinking Defence In Depth: Today A Layered Approach NSHaRP
Session 3: Lawful Interception
Session 3: Lawful Interception Secure, verifiable and intelligible audit logs to support computer forensics in lawful interception 3 rd ETSI Security Workshop Elena de la Calle Vian Ministry of Industry
Critical Information Infrastructure Protection. Role of CIRTs and Cooperation at National Level
Critical Information Infrastructure Protection Role of CIRTs and Cooperation at National Level 1 Global Cybersecurity Agenda (GCA) GCA is designed for cooperation and efficiency, encouraging collaboration
Joining forces to fight botnets. Dan Tofan Head of the Technical Division CERT-RO 17/02/2014
Joining forces to fight botnets Dan Tofan Head of the Technical Division CERT-RO 17/02/2014 Agenda Who are we? Benefits and collaboration opportunities ACDC European funded pilot project - 16 mil. Selected
building an effective action plan for the Department of Homeland Security
Customer Guide building an effective action plan for the Department of Homeland Security Binding The recently issued directive from the Department of Homeland Security (DHS), Binding Operational Directive
INTEGRATION BRIEF DFLabs and Jira: Streamline Incident Management and Issue Tracking.
INTEGRATION BRIEF DFLabs and Jira: Streamline Incident Management and Issue Tracking. Integrate IncMan SOAR s Orchestration, Automation and Response capabilities with your existing Jira solution. Solution
Stephanie Zierten Associate Counsel Federal Reserve Bank of Boston
Stephanie Zierten Associate Counsel Federal Reserve Bank of Boston Cybersecurity Landscape Major Data Breaches (e.g., OPM, IRS) Data Breach Notification Laws Directors Derivative Suits Federal Legislation
CSIRT in general CSIRT Service Categories Reactive Services Proactive services Security Quality Management Services CSIRT. Brmlab, hackerspace Prague
Brmlab, hackerspace Prague Lightning talks, November 2016 in general in general WTF is an? in general WTF is an? Computer Security in general WTF is an? Computer Security Incident Response in general WTF
Too Little Too Late: Top Reasons Why You Got Hacked
TUESDAY MAY 23,2017 2:00-3:15 PM Too Little Too Late: Top Reasons Why You Got Hacked MODERATOR SPEAKERS John Gross Director of Financial Management, City of Long Beach, CA Chad Alvarado Supervisory Special
The NIS Directive and Cybersecurity in
The NIS Directive and Cybersecurity in ehealth Dr. Athanasios Drougkas Officer in NIS Belgian Hospitals Meeting on Security Brussels 13 th October European Union Agency For Network And Information Security
Cybersecurity Strategy of the Republic of Cyprus
Cybersecurity Strategy of the Republic of Cyprus George Michaelides Commissioner of Electronic Communications and Postal Regulation http://www.ocecpr.org.cy 12 th February 2016 Cybersecurity Strategy of
One Comcast Center, Philadelphia, PA, Vice President, Internet Systems Engineering.
Review Request Form The Broadband Internet Technical Advisory Group, Inc. (BITAG) is an independent nonprofit organization, whose mission is to bring together engineers and other similar technical experts
Function Category Subcategory Implemented? Responsible Metric Value Assesed Audit Comments
Function Category Subcategory Implemented? Responsible Metric Value Assesed Audit Comments 1 ID.AM-1: Physical devices and systems within the organization are inventoried Asset Management (ID.AM): The
Security+ SY0-501 Study Guide Table of Contents
Security+ SY0-501 Study Guide Table of Contents Course Introduction Table of Contents About This Course About CompTIA Certifications Module 1 / Threats, Attacks, and Vulnerabilities Module 1 / Unit 1 Indicators
E-CoAT. European Cooperation of Abuse fighting Teams. Lessons learnt and a pragmatic way forward. ENISA Gathering in Brussels, December 2005
European Cooperation of Abuse fighting Teams Lessons learnt and a pragmatic way forward ENISA Gathering in Brussels, December 2005 Don Stikvoort (e-coat workshop chair) Abuse a massive problem (i) Computer/network
Automated Response in Cyber Security SOC with Actionable Threat Intelligence
Automated Response in Cyber Security SOC with Actionable Threat Intelligence while its biggest weakness is lack of visibility: SOCs still can t detect previously unknown threats, which is a consistent
FedRAMP: Understanding Agency and Cloud Provider Responsibilities
May 2013 Walter E. Washington Convention Center Washington, DC FedRAMP: Understanding Agency and Cloud Provider Responsibilities Matthew Goodrich, JD FedRAMP Program Manager US General Services Administration
Real-time Cyber Situational Awareness for Satellite Ground Networks. March 2015 Presenter: Ted Vera
Real-time Cyber Situational Awareness for Satellite Ground Networks March 2015 Presenter: Ted Vera Colorado Springs, CO (719) 598 2801 Denver, CO (303) 703 3834 http://www.rtlogic.com Recent Attacks NOAA
85% 89% 10/5/2018. Do You Have A Firewall Around Your Cloud? Conquering The Big Threats & Challenges
Do You Have A Firewall Around Your Cloud? California Cybersecurity Education Summit 2018 Tyson Moler Oracle Security, North America Public Sector Conquering The Big Threats & Challenges Real Life Threats
The U.S. Cybersecurity Information Sharing Act of 2015: Joel Benge Risk Evangelist Emergent Network Defense
The U.S. Cybersecurity Information Sharing Act of 2015: Joel Benge Risk Evangelist Emergent Network Defense joel@endsecurity.com Points to cover Overview History, Provisions, Challenges Implementation
The following chart provides the breakdown of exam as to the weight of each section of the exam.
Introduction The CWSP-205 exam, covering the 2015 objectives, will certify that the successful candidate understands the security weaknesses inherent in WLANs, the solutions available to address those
European Union Agency for Network and Information Security
Critical Information Infrastructure Protection in the EU Evangelos Ouzounis Head of Secure Infrastructure and Services Regional Cybersecurity Forum Sofia, Bulgaria 29 th November 2016 European Union Agency
Cloud Customer Architecture for Securing Workloads on Cloud Services
Cloud Customer Architecture for Securing Workloads on Cloud Services http://www.cloud-council.org/deliverables/cloud-customer-architecture-for-securing-workloads-on-cloud-services.htm Webinar April 19,
Incident Response. Is Your CSIRT Program Ready for the 21 st Century?
Incident Response Is Your CSIRT Program Ready for the 21 st Century? Speaker Bio Traditional Response Concepts Technical Incidents Requiring Technical Responses Virus/ Malware Network Intrusion Disaster
Directive on security of network and information systems (NIS): State of Play
Directive on security of network and information systems (NIS): State of Play Svetlana Schuster Unit H1 Cybersecurity and Digital Privacy DG Communications Networks, Content and Technology, European Commission
CIP-014. JEA Compliance Approach. FRCC Fall Compliance Workshop Presenter Daniel Mishra
CIP-014 JEA Compliance Approach FRCC Fall Compliance Workshop Presenter Daniel Mishra Acronyms & Terminologies DHS Department of Homeland Security JEA It s not an acronym JSO Jacksonville Sheriff's Office
cybersecurity in Europe Rossella Mattioli Secure Infrastructures and Services
Enhancing infrastructure cybersecurity in Europe Rossella Mattioli Secure Infrastructures and Services European Union Agency for Network and Information Security Securing Europe s Information society 2
Software Assurance Ecosystem Knowledge Architecture. 1 Wednesday, December 31, 2008
Software Assurance Ecosystem Knowledge Architecture 1 1 Wednesday, December 31, 2008 What Do The Building Blocks for Measuring Assurance Look Like? Standard ways for enumerating things we care about Languages/Formats
align security instill confidence
align security instill confidence cyber security Securing data has become a top priority across all industries. High-profile data breaches and the proliferation of advanced persistent threats have changed
Nebraska CERT Conference
Nebraska CERT Conference Security Methodology / Incident Response Patrick Hanrion Security Center of Excellence Sr. Security Consultant Agenda Security Methodology Security Enabled Business Framework methodology
MILE Implementation Report. Chris Inacio, Carnegie Mellon University Daisuke Miyamoto, The University of Tokyo
MILE Implementation Report Chris Inacio, Carnegie Mellon University Daisuke Miyamoto, The University of Tokyo daisu-mi@nc.u-tokyo.ac.jp Updates in Section 2 Information Sharing and Analysis Centers (ISAC)
Indegy. Industrial Cyber Security. ISA New Orleans Section. Applying the NIST Framework February 6, 2018
Indegy Industrial Cyber Security ISA New Orleans Section Applying the NIST Framework February 6, 2018 Agenda 1. Introductions 2. Indegy Background 3. NIST Background and History with ICS 4. What is the
Greg Garcia President, Garcia Cyber Partners Former Assistant Secretary for Cyber Security and Communications, U.S. Department of Homeland Security
1 Greg Garcia President, Garcia Cyber Partners Former Assistant Secretary for Cyber Security and Communications, U.S. Department of Homeland Security 2 Government Services 3 Business Education Social CYBERSPACE
How to Configure ATP in the Firewall
Configure when and which types of files are uploaded to the Barracuda ATP Cloud. Files with a size is limited by the Large File Watermark of the virus scanner and the 8 MB upload limit for the ATP cloud,
INCIDENTRESPONSE.COM. Automate Response. Did you know? Your playbook overview - Virus Outbreak
Automate Response Congratulations on selecting IncidentResponse.com to retrieve your custom incident response playbook guide. This guide has been created especially for you for use in within your security
Lecture #8: Correlation. Matthijs Koot / SNE-IDS college 07-08
Lecture #8: Correlation Faculteit van Natuurwetenschappen, Wiskunde en Informatica Universiteit van Amsterdam 2008-04-24 / SNE-IDS college 07-08 Outline Common problems with point-solution IDSs. Common
GDPR: Get Prepared! A Checklist for Implementing a Security and Event Management Tool. Contact. Ashley House, Ashley Road London N17 9LZ
GDPR: Get Prepared! A Checklist for Implementing a Security and Event Management Tool Contact Ashley House, Ashley Road London N17 9LZ 0333 234 4288 info@networkiq.co.uk The General Data Privacy Regulation
NGN: Carriers and Vendors Must Take Security Seriously
Research Brief NGN: Carriers and Vendors Must Take Security Seriously Abstract: The next-generation network will need to provide security on many levels. A comprehensive set of standards should be in place
Defining Computer Security Incident Response Teams
Defining Computer Security Incident Response Teams Robin Ruefle January 2007 ABSTRACT: A computer security incident response team (CSIRT) is a concrete organizational entity (i.e., one or more staff) that
Secure Development Lifecycle
Secure Development Lifecycle Strengthening Cisco Products The Cisco Secure Development Lifecycle (SDL) is a repeatable and measurable process designed to increase Cisco product resiliency and trustworthiness.
Emerging Issues: Cybersecurity. Directors College 2015
Emerging Issues: Cybersecurity Directors College 2015 Agenda/Objectives Define Cybersecurity Cyber Fraud Trends/Incidents FFIEC Cybersecurity awareness initiatives Community Bank expectations FFIEC Cybersecurity
Cyber Security for Process Control Systems ABB's view
Kaspersky ICS Cybersecurity 2017, 2017-09-28 Cyber Security for Process Control Systems ABB's view Tomas Lindström, Cyber Security Manager, ABB Control Technologies Agenda Cyber security for process control
SSL Visibility and Troubleshooting
Page 1 of 6 view online Avi Vantage provides a number of features to help understand the utilization of SSL traffic and troubleshoot SSL-related issues. Visibility Every virtual service provides a number
Simulation of Workflow and Threat Characteristics for Cyber Security Incident Response Teams
Simulation of Workflow and Threat Characteristics for Cyber Security Incident Response Teams Theodore Reed, Robert G. Abbott, Benjamin Anderson, Kevin Nauer & Chris Forsythe Sandia National Laboratories
TRAINING WEEK COURSE OUTLINE May RADISSON HOTEL TRINIDAD Port of Spain, Trinidad, W.I.
TRAINING WEEK COURSE OUTLINE May 9-13 2016 RADISSON HOTEL TRINIDAD Port of Spain, Trinidad, W.I. Page2 FACILITATOR S BIOGRAPHY John Tannahill, CA, CISM, CGEIT, CRISC is a management consultant specializing
ICBA Summary of FFIEC Cybersecurity Assessment Tool (May 2017 Update)
ICBA Summary of FFIEC Cybersecurity Assessment Tool (May 2017 Update) June 2017 INSERT YEAR HERE Contact Information: Jeremy Dalpiaz AVP, Cyber and Data Security Policy Jeremy.Dalpiaz@icba.org ICBA Summary
Audience. Overview. Enterprise Protection Platform for PCI DSS & HIPAA Compliance
Enterprise Protection Platform for PCI DSS & HIPAA Compliance Overview Sen$nelOne was founded in 2013 with a vision to develop new and groundbreaking, next genera$on endpoint protec$on solu$ons for enterprises.
Uncovering the Risk of SAP Cyber Breaches
Uncovering the Risk of SAP Cyber Breaches Research sponsored by Onapsis Independently Conducted by Ponemon Institute LLC February 2016 1 Part 1. Introduction Uncovering the Risks of SAP Cyber Breaches
Combating Today s Cyber Threats Inside Look at McAfee s Security
Combating Today s Cyber Threats Inside Look at McAfee s Security Charles Ross, Director Sales Engineering Public Sector 2008 McAfee, Inc. Agenda Today s Threat Landscape McAfee s Security Challenges McAfee
CloudSOC and Security.cloud for Microsoft Office 365
Solution Brief CloudSOC and Email Security.cloud for Microsoft Office 365 DID YOU KNOW? Email is the #1 delivery mechanism for malware. 1 Over 40% of compliance related data in Office 365 is overexposed
Connection Logging. Introduction to Connection Logging
The following topics describe how to configure the Firepower System to log connections made by hosts on your monitored network: Introduction to, page 1 Strategies, page 2 Logging Decryptable Connections
INFORMATION ASSURANCE DIRECTORATE
National Security Agency/Central Security Service INFORMATION ASSURANCE DIRECTORATE CGS Signature Repository A Signature Repository provides a group of signatures for use by network security tools such
FINNISH CYBER DEFENSE MODEL GUIDED TOUR
FINNISH CYBER DEFENSE MODEL GUIDED TOUR SPAM Botnets Identity theft Phishing Denial of Service Defacements @codenomicon BACKGROUND Sindri Bjarnason - sindri@codenomicon.com Senior Solution Engineer at
DFARS Compliance. SLAIT Consulting SECURITY SERVICES. Mike D Arezzo Director of Security Services. SLAITCONSULTING.com
DFARS Compliance SLAIT Consulting SECURITY SERVICES Mike D Arezzo Director of Security Services Introduction 18+ year career in Information Technology and Security General Electric (GE) as Software Governance
Integrated, Intelligence driven Cyber Threat Hunting
Integrated, Intelligence driven Cyber Threat Hunting THREAT INVESTIGATION AND RESPONSE PLATFORM Zsolt Kocsis IBM Security Technical Executive, CEE zsolt.kocsis@hu.ibm.com 6th Nov 2018 Build an integrated
Introduction to Network Discovery and Identity
The following topics provide an introduction to network discovery and identity policies and data: Host, Application, and User Detection, page 1 Uses for Host, Application, and User Discovery and Identity
Internet Continuous Situation Awareness
Internet Continuous Situation Awareness Prof. Dr. Norbert Pohlmann Institute for Internet Security - if(is) University of Applied Sciences Gelsenkirchen http://www.internet-sicherheit.de Content Structure
Vulnerabilities. To know your Enemy, you must become your Enemy. Information security: Vulnerabilities & attacks threats. difficult.
Vulnerabilities To know your Enemy, you must become your Enemy. "The Art of War", Sun Tzu André Zúquete Security 1 Information security: Vulnerabilities & attacks threats Discouragement measures difficult