Living with compromise: Enterprise Network Survival in tough Russian Environment
|
|
|
- Sherman Norton
- 5 years ago
- Views:
Transcription
1 Living with compromise: Enterprise Network Survival in tough Russian Environment Vladimir Kropotov, Vitaly Chetvertakov, Fyodor Yarochkin HITCON 2014 Aug 20, 2014, Taipei
2 Outline Agenda Prerequizites and Experience Know your history Incidents: detection, prevention Tools and Execution Incident Response Questions
3 Agenda Prerequisites and past Experience share practical experience in an enterprise defense that lead to particular conclusions Tools and implemention demonstrate tools and techniques that improve detection aid incident handling lifecycle
4 You are or will be compromised If you are under attack, your AV,Firewaslls, IDS, etc. are in THE ATTACKER THREATS MODEL. The option you have - read between the lines. When you are compromised, what is the action plan? Are you able to: Detect Properly: Categorise Mitgate Investigate...
5 Threat Landscape Assumption - Not isolated big networks are (almost) always somehow compromised During the last year about 30% of monitored hosts was attacked by cybercrimes at least once. For Basic setup Host AV, Proxy with AV, firewalls, IPS, etc... Success rate 3-15% If you have 10k hosts network in Russia, about 3k host will be attacked and will be compromised on average. Approximate this situation to 40M hosts... What to do?
6 Threat Identification Identify threats within detection capabilities of your organisation. There always will be threats your org can t detect or handle. You have to accept the risk (or allocate additional resources to mitigate it).
7 Examples of an Org. Strength: You have Good monitoring team - otherwise you can ONLY rely on your security vendors opinion and support in handling security incidents. BAD! Defense in Depth: Have multipe independent layers of protection monitoring or mitigation. Examples: sinkholes redirect botnet traffic to internal sinkholes. proxy blacklist prevents access to botnet resources. and so on. This also decreases risks of your organization to be blacklisted in public blacklists, such as spamhaus, shadowserver lists (SPB, RSBL).
8 Examplies of possible org Limitations: No security team, IT operations outsourced :) HUGE distributed Not centralized environment. No uniform defense mechanisms. Limited ability to control and monitor IT and SECURITY events No recording of forensic evidence Distributed, uncommunicating IT support teams
9 Identify your Attack Surface browser? mail? vpn? rewmovable devices?publically accessable asset? Untrusted vendor?
10 Attacker information gathering Targetted Attackers want your data. They have time. Not every javascript serves exploit. Some are just recording information on your environment.
11 Attacker exploitation vuls vs kis (based on Mila/contagiodump repo data):
12 Know your history Incident history datamining. Case studies of Incident and Incident Response
13 An Incident Lifestype stages in life of an incident Incident (Almost) Happens Incident Detected Additional Information Collected Short-Term Impact Minimization Incident Categorized Long-Term Mitigation plan (typical/ not typical) Mitigation plan implementation QOS (Mitigation assurance): CHECK! Indicators of Compromise (IOCs) preservation Check for presence of IOCs in other parts of monitoring Environments Store incident data, update knowledge base, collect useful stats to speed up future incident handling.
14 Be sure that measures are effective.
15 Incidents Characteristics of incidents How to enhance security measures How to prevent further recurrence
16 Classification of Incidents Examples: Malicious code Malicious code, with consequential network activity Anomalous activity Out of the scope of Enterprise Network Activity Untrusted executable Direct reputation risk Indirect reputation risk Targeted Attack (APT)
17 Incidents vs Systems(1) Incidents VS Systems: Usability of various components common belief incidents/systems firewalls AV web traf IPS DNS Profiling Malicious code 10 Malicious code, with Anomalous activity 5 5 Out of the scope Untrusted executable 7 3 Direct reputation risk Indirect reputation risk Targeted Attack (APT) 8 2
18 Incidents vs Systems(2) Incidents VS Systems: Usability of various components reality incidents/systems firewalls AV web traf IPS DNS Profiling Malicious code 4 6 Malicious code, with Anomalous activity Out of the scope Untrusted executables Direct reputation risk 10 Indirect reputation risk 10 Targeted Attack (APT) 8 2
19 Examples: Web Traffic Analysis Proxy and passive HTTP traffic analysis Sources: proxy logs passive web traffic monitoring (including HTTPS)
20 Example url ip mime type size code cuba.eanuncios.net/1/zf3z9lr6ac8di6r4kw2r0hu3ee8ad.html text/html cuba.eanuncios.net/ /1/ htm text/html cuba.eanuncios.net/ /1/ jar application/java-archive cuba.eanuncios.net/ /1/ jar application/java-archive cuba.eanuncios.net/f/1/ / / application/octet-stream cuba.eanuncios.net/f/1/ / /2/ What just happened?
21 Examples: DNS Passive DNS traffic acquisition and analysis a couple of examples (last week) domain ip owner rtvwerjyuver.com linode tvrstrynyvwstrtve.com linode cu wfaxyqykxh.ru... what does your DNS traffic look like..?
22 DNS viz01
23 DNS viz02
24 DNS anonymizer traffc Anonimizer 8/13/2014 9:59:12 PM - ##.##.##.## - 0s.o53xo.pfxxk5dvmjss4y3pnu.dd34.ru 8/13/2014 9:59:12 PM - ##.##.##.## - o53xo.pfxxk5dvmjss4y3pnu.dd34.ru 8/13/2014 9:59:12 PM - ##.##.##.## - o53xo.pfxxk5dvmjss4y3pnu.dd34.ru 8/13/2014 9:59:12 PM - ##.##.##.## - 0s.om.pf2gs3lhfzrw63i.dd34.ru 8/13/2014 9:59:12 PM - ##.##.##.## - 0s.om.pf2gs3lhfzrw63i.dd34.ru 8/13/2014 9:59:12 PM - ##.##.##.## - nbxxe33tnbuxsllwnn2xg.mjuxultvme.dd 8/13/2014 9:59:12 PM - ##.##.##.## - nbxxe33tnbuxsllwnn2xg.mjuxultvme.dd 8/13/2014 9:59:12 PM - ##.##.##.## - 0s.ne.pf2gs3lhfzrw63i.dd34.ru 8/13/2014 9:59:12 PM - ##.##.##.## - 0s.ne.pf2gs3lhfzrw63i.dd34.ru 8/13/2014 9:59:15 PM - ##.##.##.## - obuwg4y.nruxmzlkn52xe3tbnqxgg33n.d 8/13/2014 9:59:15 PM - ##.##.##.## - obuwg4y.nruxmzlkn52xe3tbnqxgg33n.d 8/13/2014 9:59:15 PM - ##.##.##.## - 0s.o53xo.mzqwgzlcn5xwwltdn5wq.dd34 8/13/2014 9:59:15 PM - ##.##.##.## - 0s.o53xo.mzqwgzlcn5xwwltdn5wq.dd34 Time: Today 09:59:15pm Affilations: Description: AcademiaPhishing.bpwh Sinica, o0o.nu, chroot.org
25 Covert channel communication 8/13/ : 4 9 : 0 4 PM x. x. x. x mtdtzwdhc. mdgtmtmmd 8/13/ : 4 9 : 0 4 PM x. x. x. x mtdtzwdhc. mdgtmtmmd Time : Today 1 3 : 1 9 : 2 5 D e s c r i p t i o n : REP. b i l s c z Detected at Today 1 3 : 1 9 : 2 5 I n t e r f a c e Name : bond1.382 I n t e r f a c e D i r e c t i o n : outbound
26 Sinkhole in DNS Credit: domaintools.com
27 Sinkhole in DNS Credit: domaintools.com
28 DNS Suspicious activity: DNS lookups: kojxlvfkpl.biz: kojxlvfkpl.biz: kojxlvfkpl.biz:
29 Look for holes :)
30 Hole traffic
31 Usability of sandboxes Sandboxes could be helpful to analyze mal. content. However, they are often not very practical. A few examples (delivery via SMTP) 1.zip FW supplier data form.msg How to Get Thin Quick.msg Losing a size within a fortnight It s easy.msg msg
32 Problems with Sandboxing Known tricks matching environment code behaves differently depending on: environment, time, user interaction, time-zone,.. performance (timeouts,..) Use interaction
33 Stages of incident detection Before Incident (Security Awareness, Pentests, etc.) Access attempt Access obtained Privilege escalation Execution of attack goal Post-incident IR (too late)) Incidents VS Stages of detection ~= how monitoring team operates with current limitations in Environment
34 Incidents VS Stages of detection(1) common belief incidents/stages before attempt obtained escl impl late Malicious code 5 5 Malicious code, with Anomalous activity 8 2 Out of the scope.. Untrusted executables 1 9 Direct reputation risk 10 Indirect reputation risk 10 Targeted Attack (APT) 8 2
35 Incidents VS Stages of detection(2) reality incidents/stages before attempt obtained escl impl late Malicious code Malicious code, with Anomalous activity Out of the scope Untrusted executables Direct reputation risk Indirect reputation risk Targeted Attack (APT)
36 Attack delivery method incidents/delivery web ext.storage share services other Malicious code Malicious code, with Anomalous activity Out of the scope Untrusted executables Direct reputation risk Indirect reputation risk Targeted Attack (APT)
37 How can you improve your security posture Cross-correlate your historical data including data from following sources: Incidents Detection systems (ips/ids/av/fw/..): map type of incident to component that detects those. Stages of detection - and incidents Delivery method - which network detection components detect what delivery methods. use community contributions :)
38 Specific incident attributes Availability first Conflict of interest: flag Restrictions on information sharing: limits the quality of teams collaboration Manual routing of information sharing for the special cases
39 Incidents categorization Categorisation based on Vendor knowledge Categorisation based on public sources Categorisation based on internal intel. Categorisation based on limited IOCs sharing to the focused groups Attribution
40 Tools and Execution There is a number of tools we can share. Some are developed by us. Other - are just very good open source projects. fiddler elasticsearch && (vm) yara (as moloch plugin) hpfeeds CIF Indicators of Compromise is one of essential information mediums here to represent facts on incident(s).
41 Mining public knowledge There is a lot of public knowledge you could mine. CIF is a fantastic tool for that.
42 CIF: example grabbing shadowserver data:
43 CIF: example
44 IOC representations Multiple standards have been created to facilitate IOC exchanges. Madiant: OpenIOC Mitre: STIX (Structured Threat Information Expression), CyBOX (CyberObservable Expression) Mitre: CAPEC, TAXII IODEF (Incident Object Description Format)
45 Standards: OpenIOC OpenIOC - Mandiant-backed effort for unform representation of IOC (now FireEye)
46 RAW Data Preservation
47 Moloch as detection tool
48 Tools for Dynamic Detection Moloch Moloch supports Yara (IOCs can be directly applied) Moloch allows you to develop your own plugins Moloch has awesome tagger plugin: # t a g g e r. so # p r o v i d e s a b i l i t y to import t e x t f i l e s with IP and/ or hostn # i n t o a s e n s o r t h a t would cause a u t o t a g g i n g o f a l l matching p l u g i n s=t a g g e r. so t a g g e r I p F i l e s=b l a c k l i s t, tag, tag, tag... t a g g e r D o m a i n F i l e s=d o m a i n b a s e d b l a c k l i s t s, tag, tag, tag
49 Extending Moloch Moloch is easily extendable with your own plugins - makes it easy to integrate other things with moloch via zmq queue pub/sub or push/pull model
50 Moloch ZMQ example CEP-based analysis of network-traffic (using ESPER):
51 Fake targets Honeypots are very useful when dealing with unknown threats or when dealing with environments with limited capabilities (VPN, BYOD,..)
52 Honeypot data sharing HPFeeds could be used to share honeypot data feeds in controlled manner via your own broker.
53 Last not least :) Incident response: your availability is impacted by your investigation capabilities.
54 Incident Response: some details Ways to determine scope (impact) Ways to minimize scope (impact) Response to the threats with known scope (impact) Response to the threats with unknown scope (impact) Keep historical record of the process.
55 Questions Q&A our slides:
Automated Response in Cyber Security SOC with Actionable Threat Intelligence
Automated Response in Cyber Security SOC with Actionable Threat Intelligence while its biggest weakness is lack of visibility: SOCs still can t detect previously unknown threats, which is a consistent
Cyber Threat Intelligence Standards - A high-level overview
Cyber Threat Intelligence Standards - A high-level overview Christian Doerr TU Delft, Cyber Threat Intelligence Lab Delft University of Technology Challenge the future ~ whoami At TU Delft since 2008 in
CloudSOC and Security.cloud for Microsoft Office 365
Solution Brief CloudSOC and Email Security.cloud for Microsoft Office 365 DID YOU KNOW? Email is the #1 delivery mechanism for malware. 1 Over 40% of compliance related data in Office 365 is overexposed
Cybersecurity Auditing in an Unsecure World
About This Course Cybersecurity Auditing in an Unsecure World Course Description $5.4 million that s the average cost of a data breach to a U.S.-based company. It s no surprise, then, that cybersecurity
ArcSight Activate Framework
ArcSight Activate Framework Petropoulos #HPProtect 44% Have trouble managing their SIEM eiqnetworks 2013 SIEM Survey #1 challenge Identification of key events SANS 2012 Log Management and Event Management
THREAT MANAGEMENT AND OUR TECHNICAL LEARNINGS IMPLEMENTING CTI
LIFE AFTER THREAT INTELLIGENCE EXCHANGE THREAT MANAGEMENT AND OUR TECHNICAL LEARNINGS IMPLEMENTING CTI Joep Gommers @joepgommers Marko Dragoljevic @chipi_nbgd Download whitepaper http://bit.do/threatintel
Incident Play Book: Phishing
Incident Play Book: Phishing Issue: 1.0 Issue Date: September 12, 2017 Copyright 2017 Independent Electricity System Operator. Some Rights Reserved. The following work is licensed under the Creative Commons
Symantec Ransomware Protection
Symantec Ransomware Protection Protection Against Ransomware Defense in depth across all control points is required to stop ransomware @ Email Symantec Email Security.cloud, Symantec Messaging Gateway
THE RSA SUITE NETWITNESS REINVENT YOUR SIEM. Presented by: Walter Abeson
THE RSA NETWITNESS SUITE REINVENT YOUR SIEM Presented by: Walter Abeson 1 Reality Goals GOALS VERSUS REALITY OF SIEM 1.0 Single compliance & security interface Analyze & prioritize alerts across various
Threat Containment and Operations. Yong Kwang Kek, Director of Presales SE, APJ
Threat Containment and Operations Yong Kwang Kek, Director of Presales SE, APJ 2018-07-19 1 1 2017 Infoblox Inc. All Rights 2013 Infoblox Inc. All Reserved. Rights Reserved. Three Aspects of Security #1
RSA INCIDENT RESPONSE SERVICES
RSA INCIDENT RESPONSE SERVICES Enabling early detection and rapid response EXECUTIVE SUMMARY Technical forensic analysis services RSA Incident Response services are for organizations that need rapid access
Incident Response Agility: Leverage the Past and Present into the Future
SESSION ID: SPO1-W03 Incident Response Agility: Leverage the Past and Present into the Future Torry Campbell CTO, Endpoint and Management Technologies Intel Security The Reality we Face Reconnaissance
One Phish, Two Phish, Three! Building an Active Threat Management Framework for Malicious
One Phish, Two Phish, Three! Building an Active Threat Management Framework for Malicious Email - Ron Weiss, Incident Response Team lead Disclaimer: The information in this presentation is based on lessons
The U.S. Cybersecurity Information Sharing Act of 2015: Joel Benge Risk Evangelist Emergent Network Defense
The U.S. Cybersecurity Information Sharing Act of 2015: Joel Benge Risk Evangelist Emergent Network Defense joel@endsecurity.com Points to cover Overview History, Provisions, Challenges Implementation
Arbor Networks Spectrum. Wim De Niel Consulting Engineer EMEA
Arbor Networks Spectrum Wim De Niel Consulting Engineer EMEA wdeniel@arbor.net Arbor Spectrum for Advanced Threats Spectrum Finds Advanced Threats with Network Traffic Unlocks Efficiency to Detect, Investigate,
Un SOC avanzato per una efficace risposta al cybercrime
Un SOC avanzato per una efficace risposta al cybercrime Identificazione e conferma di un incidente @RSAEMEA #RSAEMEASummit @masiste75 Mauro Costantini - Presales Consultant Agenda A look into the threat
10 KEY WAYS THE FINANCIAL SERVICES INDUSTRY CAN COMBAT CYBER THREATS
10 KEY WAYS THE FINANCIAL SERVICES INDUSTRY CAN COMBAT CYBER THREATS WHITE PAPER INTRODUCTION BANKS ARE A COMMON TARGET FOR CYBER CRIMINALS AND OVER THE LAST YEAR, FIREEYE HAS BEEN HELPING CUSTOMERS RESPOND
Detect & Respond to IoT Botnets AS AN ISP. Christoph Giese Telekom Security; Cyber DefenSe Center
Detect & Respond to IoT Botnets AS AN ISP Christoph Giese Telekom Security; Cyber DefenSe Center Management Summary Mirai hit us hard; IoT Botnets are on the rise and rapidly evolving We developed a three-stage
Speed Up Incident Response with Actionable Forensic Analytics
WHITEPAPER DATA SHEET Speed Up Incident Response with Actionable Forensic Analytics Close the Gap between Threat Detection and Effective Response with Continuous Monitoring January 15, 2015 Table of Contents
Surprisingly Successful: What Really Works in Cyber Defense. John Pescatore, SANS
Surprisingly Successful: What Really Works in Cyber Defense John Pescatore, SANS 1 Largest Breach Ever 2 The Business Impact Equation All CEOs know stuff happens in business and in security The goal is
Evolution Of Cyber Threats & Defense Approaches
Evolution Of Cyber Threats & Defense Approaches Antony Abraham IT Architect, Information Security, State Farm Kevin McIntyre Tech Lead, Information Security, State Farm Agenda About State Farm Evolution
RSA INCIDENT RESPONSE SERVICES
RSA INCIDENT RESPONSE SERVICES Enabling early detection and rapid response EXECUTIVE SUMMARY Technical forensic analysis services RSA Incident Response services are for organizations that need rapid access
Threat Centric Network Security
BRKSEC-2056 Threat Centric Network Security Ted Bedwell, Principal Engineer Network Threat Defence Cisco Spark How Questions? Use Cisco Spark to communicate with the speaker after the session 1. Find this
ISO COMPLIANCE GUIDE. How Rapid7 Can Help You Achieve Compliance with ISO 27002
ISO 27002 COMPLIANCE GUIDE How Rapid7 Can Help You Achieve Compliance with ISO 27002 A CONTENTS Introduction 2 Detailed Controls Mapping 3 About Rapid7 8 rapid7.com ISO 27002 Compliance Guide 1 INTRODUCTION
SO YOU THINK YOU ARE PROTECTED? THINK AGAIN! NEXT GENERATION ENDPOINT SECURITY
SO YOU THINK YOU ARE PROTECTED? THINK AGAIN! NEXT GENERATION ENDPOINT SECURITY www.securelink.net BACKGROUND Macro trends like cloud and mobility change the requirements for endpoint security. Data can
Sandboxing and the SOC
Sandboxing and the SOC Place McAfee Advanced Threat Defense at the center of your investigation workflow As you strive to further enable your security operations center (SOC), you want your analysts and
WHITE PAPER. Operationalizing Threat Intelligence Data: The Problems of Relevance and Scale
WHITE PAPER Operationalizing Threat Intelligence Data: The Problems of Relevance and Scale Operationalizing Threat Intelligence Data: The Problems of Relevance and Scale One key number that is generally
RSA ECAT DETECT, ANALYZE, RESPOND!
RSA ECAT DETECT, ANALYZE, RESPOND! Cyber Threat Landscape Attack surface (& attackers) expanding Web app Existing strategies & controls are failing Laptop EHR Firewall Attacks sophistication on the rise
ATTIVO NETWORKS THREATDEFEND INTEGRATION WITH MCAFEE SOLUTIONS
PARTNER BRIEF ATTIVO NETWORKS THREATDEFEND INTEGRATION WITH MCAFEE SOLUTIONS INTRODUCTION Attivo Networks has partnered with McAfee to detect real-time in-network threats and to automate incident response
McAfee Advanced Threat Defense
Advanced Threat Defense Detect advanced malware Advanced Threat Defense enables organizations to detect advanced, evasive malware and convert threat information into immediate action and protection. Unlike
align security instill confidence
align security instill confidence cyber security Securing data has become a top priority across all industries. High-profile data breaches and the proliferation of advanced persistent threats have changed
Automating Security Response based on Internet Reputation
Add Your Logo here Do not use master Automating Security Response based on Internet Reputation IP and DNS Reputation for the IPS Platform Anthony Supinski Senior Systems Engineer www.h3cnetworks.com www.3com.com
Emerging Threat Intelligence using IDS/IPS. Chris Arman Kiloyan
Emerging Threat Intelligence using IDS/IPS Chris Arman Kiloyan Who Am I? Chris AUA Graduate (CS) Thesis : Cyber Deception Automation and Threat Intelligence Evaluation Using IDS Integration with Next-Gen
Cyber Common Technical Core (CCTC) Advance Sheet Windows Operating Systems
Cyber Common Technical Core (CCTC) Advance Sheet Windows Operating Systems Section 1: Command Line Tools Skill 1: Employ commands using command line interface 1.1 Use command line commands to gain situational
Application Whitelisting and Active Analysis Nick Levay, Chief Security Officer, Bit9
Application Whitelisting and Active Analysis Nick Levay, Chief Security Officer, Bit9 About Me Chief Security Officer @ Bit9 Former Director of Technical Operations and Information Security @ Center for
A Comprehensive CyberSecurity Policy
A Comprehensive CyberSecurity Policy Review of ALL NGFW Capabilities Attack Surface Reduction From Complex to Comprehensive Before and After of a PANW customer 1 2 1 Enhanced Policy on the L7 layer Leverage
Managed Enterprise Phishing Protection. Comprehensive protection delivered 24/7 by anti-phishing experts
Managed Enterprise Phishing Protection Comprehensive protection delivered 24/7 by anti-phishing experts MANAGED ENTERPRISE PHISHING PROTECTION 24/7 expert protection against phishing attacks that get past
SIEM Solutions from McAfee
SIEM Solutions from McAfee Monitor. Prioritize. Investigate. Respond. Today s security information and event management (SIEM) solutions need to be able to identify and defend against attacks within an
Protection - Before, During And After Attack
Advanced Malware Protection for FirePOWER TM BENEFITS Continuous detection of malware - immediately and retrospectively Inline detection of sophisticated malware that evades traditional network protections
WHITE PAPER HIGH-FIDELITY THREAT INTELLIGENCE: UNDERSTANDING FALSE POSITIVES IN A MULTI-LAYER SECURITY STRATEGY
WHITE PAPER HIGH-FIDELITY THREAT INTELLIGENCE: UNDERSTANDING FALSE POSITIVES IN A MULTI-LAYER SECURITY STRATEGY Dave Dubois, Global Security Product Management Version: 1.0, Jan 2018 A Multi-Layer Approach
Reducing the Cost of Incident Response
Reducing the Cost of Incident Response Introduction Cb Response is the most complete endpoint detection and response solution available to security teams who want a single platform for hunting threats,
The Invisible Threat of Modern Malware Lee Gitzes, CISSP Comm Solutions Company
The Invisible Threat of Modern Malware Lee Gitzes, CISSP Comm Solutions Company November 12, 2014 Malware s Evolution Why the change? Hacking is profitable! Breaches and Malware are Projected to Cost $491
WHITE PAPER. AirGap. The Technology That Makes Isla a Powerful Web Malware Isolation System
AirGap The Technology That Makes Isla a Powerful Web Malware Isolation System Introduction Web browsers have become a primary target for cyber attacks on the enterprise. If you think about it, it makes
Digital Forensics Readiness PREPARE BEFORE AN INCIDENT HAPPENS
Digital Forensics Readiness PREPARE BEFORE AN INCIDENT HAPPENS Digital Forensics Readiness: PREPARE BEFORE AN INCIDENT HAPPENS 2 Digital Forensics Readiness The idea that all networks can be compromised
Improved C&C Traffic Detection Using Multidimensional Model and Network Timeline Analysis
Improved C&C Traffic Detection Using Multidimensional Model and Elad Menahem Avidan Avraham Modern Threats Are More Sophisticated & Evasive CYBER KILL CHAIN: Infection Phase Post-Infection Recon Weaponization
How to Identify Advanced Persistent, Targeted Malware Threats with Multidimensional Analysis
White paper How to Identify Advanced Persistent, Targeted Malware Threats with Multidimensional Analysis AhnLab, Inc. Table of Contents Introduction... 1 Multidimensional Analysis... 1 Cloud-based Analysis...
Intelligent and Secure Network
Intelligent and Secure Network BIG-IP IP Global Delivery Intelligence v11.2 IP Intelligence Service Brian Boyan - b.boyan@f5.com Tony Ganzer t.ganzer@f5.com 2 Agenda Welcome & Intro Introduce F5 IP Intelligence
Incident Scale
SESSION ID: SOP-T07 Incident Response @ Scale Salah Altokhais Incident Response Consultant National Cyber Security Center (NCSC),KSA @salah.altokhais Khalid Alsuwaiyel Incident Response Specialist National
CounterACT IOC Scanner Plugin
CounterACT IOC Scanner Plugin Version 2.0.1 Table of Contents About the CounterACT IOC Scanner Plugin... 4 Use Cases... 5 Broaden the Scope and Capacity of Scanning Activities... 5 Use CounterACT Policy
Seceon s Open Threat Management software
Seceon s Open Threat Management software Seceon s Open Threat Management software (OTM), is a cyber-security advanced threat management platform that visualizes, detects, and eliminates threats in real
NIST Framework for Improving Critical Infrastructure Cybersecurity Technical Control Automation
NIST Framework for Improving Critical Infrastructure Cybersecurity Technical Control Automation Automating Cybersecurity Framework Technical Controls with Tenable SecurityCenter Continuous View February
Information Security Controls Policy
Information Security Controls Policy Classification: Policy Version Number: 1-00 Status: Published Approved by (Board): University Leadership Team Approval Date: 30 January 2018 Effective from: 30 January
Supercharge Your SIEM: How Domain Intelligence Enhances Situational Awareness
Supercharge Your SIEM: How Domain Intelligence Enhances Situational Awareness Introduction Drowning in data but starving for information. It s a sentiment that resonates with most security analysts. For
Cyber Threat Intelligence Sharing Standards
SESSION ID: PST-W08 Cyber Threat Intelligence Sharing Standards Jerome Athias Cybersecurity Specialist Saudi Aramco @JA25000 Agenda Cyber Threat Intelligence (CTI) CTI Sharing Standards Summary & Apply
Essentials to creating your own Security Posture using Splunk Enterprise
Essentials to creating your own Security Posture using Splunk Enterprise Using Splunk to maximize the efficiency and effectiveness of the SOC / IR Richard W. McKee, MS-ISA, CISSP Principal Cyber Security
CHECK POINT SANDBLAST MOBILE BEHAVIORAL RISK ANALYSIS
CHECK POINT SANDBLAST MOBILE BEHAVIORAL RISK ANALYSIS AN ADVANCED APPROACH TO COMPREHENSIVE MOBILE SECURITY Accurate threat detection and efficient response are critical components of preventing advanced
Key Technologies for Security Operations. Copyright 2014 EMC Corporation. All rights reserved.
Key Technologies for Security Operations 2 Traditional Security Is Not Working 97% of breaches led to compromise within days or less with 72% leading to data exfiltration in the same time Source: Verizon
Defining Computer Security Incident Response Teams
Defining Computer Security Incident Response Teams Robin Ruefle January 2007 ABSTRACT: A computer security incident response team (CSIRT) is a concrete organizational entity (i.e., one or more staff) that
Juniper Sky Advanced Threat Prevention
Juniper Sky Advanced Threat Prevention Product Overview Juniper Sky Advanced Threat Prevention is a cloud-based service that provides complete advanced malware protection. Integrated with SRX Series Services
JUNIPER SKY ADVANCED THREAT PREVENTION
Data Sheet JUNIPER SKY ADVANCED THREAT PREVENTION Product Overview Juniper Sky Advanced Threat Prevention is a cloud-based service that provides complete advanced malware protection. Integrated with SRX
Enabling Distributed Event Management: Interoperability for Automated Response and Prevention. Sean Barnum George Saylor Aug 2011
Enabling Distributed Event Management: Interoperability for Automated Response and Prevention Sean Barnum George Saylor Aug 2011 The HS SEDI FFRDC is managed and operated by The MITRE Corporation for DHS.
NEXT GENERATION SECURITY OPERATIONS CENTER
DTS SOLUTION NEXT GENERATION SECURITY OPERATIONS CENTER SOC 2.0 - ENHANCED SECURITY O&M SOC 2.0 - SUCCESS FACTORS SOC 2.0 - FUNCTIONAL COMPONENTS DTS SOLUTION SOC 2.0 - ENHANCED SECURITY O&M SOC 2.0 Protecting
ForeScout CounterACT. Configuration Guide. Version 2.2
ForeScout CounterACT Core Extensions Module: IOC Scanner Plugin Version 2.2 Table of Contents About the CounterACT IOC Scanner Plugin... 4 Use Cases... 5 Broaden the Scope and Capacity of Scanning Activities...
Threat Detection and Mitigation for IoT Systems using Self Learning Networks (SLN)
Threat Detection and Mitigation for IoT Systems using Self Learning Networks (SLN) JP Vasseur, PhD - Cisco Fellow jpv@cisco.com Maik G. Seewald, CISSP Sr. Technical Lead maseewal@cisco.com June 2016 Cyber
RiskSense Attack Surface Validation for IoT Systems
RiskSense Attack Surface Validation for IoT Systems 2018 RiskSense, Inc. Surfacing Double Exposure Risks Changing Times and Assessment Focus Our view of security assessments has changed. There is diminishing
NETWORK FORENSIC ANALYSIS IN THE AGE OF CLOUD COMPUTING.
NETWORK FORENSIC ANALYSIS IN THE AGE OF CLOUD COMPUTING. The old mantra of trust but verify just is not working. Never trust and verify is how we must apply security in this era of sophisticated breaches.
CNIT 50: Network Security Monitoring. 9 NSM Operations
CNIT 50: Network Security Monitoring 9 NSM Operations Topics The Enterprise Security Cycle Collection, Analysis, Escalation, and Resolution Remediation Introduction Methodology is more important than tools
Deception: Deceiving the Attackers Step by Step
Deception: Deceiving the Attackers Step by Step TrapX Security, Inc. February, 2018 In 2017, Gartner emphasized how companies are transforming their security spending strategy and moving away from prevention-only
Building Resilience in a Digital Enterprise
Building Resilience in a Digital Enterprise Top five steps to help reduce the risk of advanced targeted attacks To be successful in business today, an enterprise must operate securely in the cyberdomain.
The SANS Institute Top 20 Critical Security Controls. Compliance Guide
The SANS Institute Top 20 Critical Security Controls Compliance Guide February 2014 The Need for a Risk-Based Approach A common factor across many recent security breaches is that the targeted enterprise
Author: Tonny Rabjerg Version: Company Presentation WSF 4.0 WSF 4.0
Author: Tonny Rabjerg Version: 20150730 Company Presentation WSF 4.0 WSF 4.0 Cybercrime is a growth industry. The returns are great, and the risks are low. We estimate that the likely annual cost to the
External Supplier Control Obligations. Cyber Security
External Supplier Control Obligations Cyber Security Control Title Control Description Why this is important 1. Cyber Security Governance The Supplier must have cyber risk governance processes in place
MISP Training: MISP Deployment and Integration
Team CIRCL MISP Training: MISP Deployment and Integration http://www.misp-project.org/ Twitter: @MISPProject MISP Training @ OTTO Group 20190228 A Common Integration 1 11 Recommended MISP Setup Provisioning
Tanium Endpoint Detection and Response. (ISC)² East Bay Chapter Training Day July 13, 2018
Tanium Endpoint Detection and Response (ISC)² East Bay Chapter Training Day July 13, 2018 $> WhoamI 11 Years of Security Experience Multiple Verticals (Technology, Industrial, Healthcare, Biotech) 9 Years
Security by Default: Enabling Transformation Through Cyber Resilience
Security by Default: Enabling Transformation Through Cyber Resilience FIVE Steps TO Better Security Hygiene Solution Guide Introduction Government is undergoing a transformation. The global economic condition,
Specialized Security Services, Inc. REDUCE RISK WITH CONFIDENCE. s3security.com
Specialized Security Services, Inc. REDUCE RISK WITH CONFIDENCE s3security.com Security Professional Services S3 offers security services through its Security Professional Services (SPS) group, the security-consulting
CYBER RESILIENCE & INCIDENT RESPONSE
CYBER RESILIENCE & INCIDENT RESPONSE www.nccgroup.trust Introduction The threat landscape has changed dramatically over the last decade. Once the biggest threats came from opportunist attacks and preventable
RSA NetWitness Suite Respond in Minutes, Not Months
RSA NetWitness Suite Respond in Minutes, Not Months Overview One can hardly pick up a newspaper or turn on the news without hearing about the latest security breaches. The Verizon 2015 Data Breach Investigations
eguide: Designing a Continuous Response Architecture 5 Steps to Reduce the Complexity of PCI Security Assessments
eguide: Designing a Continuous Response Architecture 5 Steps to Reduce the Complexity of PCI Security Assessments Today s PCI compliance landscape is one of continuing change and scrutiny. Given the number
Security Automation & Orchestration That Won t Get You Fired. Syra Arif Advisory Security Solutions Architect November 2017
Security Automation & Orchestration That Won t Get You Fired Syra Arif Advisory Security Solutions Architect ServiceNow @syraarif November 2017 1 Speaker Introduction NAME: Syra Arif TITLE: Advisory Security
Advanced Endpoint Protection
Advanced Endpoint Protection Protecting Endpoints and Servers Nick Levay, Chief Security Officer, Bit9 @rattle1337 2014 Bit9. All Rights Reserved About Me Chief Security Officer, Bit9
Technical Overview TDAC Anomaly Detection. copyright 2018 by Telesoft Technologies. All rights reserved.
Technical Overview TDAC Anomaly Detection www.telesoft-technologies.com copyright 2018 by Telesoft Technologies. All rights reserved. TDAC Anomaly Detection The volume of network events within National
CyberArk Privileged Threat Analytics
CyberArk Privileged Threat Analytics Table of Contents The New Security Battleground: Inside Your Network 3 Privileged account security 3 Collect the right data 4 Detect critical threats 5 Alert on critical
MCAFEE INTEGRATED THREAT DEFENSE SOLUTION
IDC Lab Validation Report, Executive Summary MCAFEE INTEGRATED THREAT DEFENSE SOLUTION Essential Capabilities for Analyzing and Protecting Against Advanced Threats By Rob Ayoub, CISSP, IDC Security Products
CISCO NETWORKS BORDERLESS Cisco Systems, Inc. All rights reserved. 1
CISCO BORDERLESS NETWORKS 2009 Cisco Systems, Inc. All rights reserved. 1 Creating New Business Models The Key Change: Putting the Interaction Where the Customer Is Customer Experience/ Innovation Productivity/
Eliminating the Blind Spot: Rapidly Detect and Respond to the Advanced and Evasive Threat
WHITE PAPER Eliminating the Blind Spot: Rapidly Detect and Respond to the Advanced and Evasive Threat Executive Summary Unfortunately, it s a foregone conclusion that no organisation is 100 percent safe
Intro to Niara. no compromise behavioral analytics. Tomas Muliuolis HPE Aruba Baltics Lead
Intro to Niara no compromise behavioral analytics Tomas Muliuolis HPE Aruba Baltics Lead THE SECURITY GAP SECURITY SPEND DATA BREACHES 146 days median time from compromise to discovery PREVENTION & DETECTION
The Credential Phishing Handbook. Why It Still Works and 4 Steps to Prevent It
The Credential Phishing Handbook Why It Still Works and 4 Steps to Prevent It Introduction Phishing is more than 20 years old, but still represents more than 90% of targeted attacks. The reason is simple:
MOBILE THREAT PREVENTION
MOBILE THREAT PREVENTION BEHAVIORAL RISK ANALYSIS AN ADVANCED APPROACH TO COMPREHENSIVE MOBILE SECURITY Accurate threat detection and efficient response are critical components of preventing advanced attacks
Protecting Against Modern Attacks. Protection Against Modern Attack Vectors
Protecting Against Modern Attacks Protection Against Modern Attack Vectors CYBER SECURITY IS A CEO ISSUE. - M C K I N S E Y $4.0M 81% >300K 87% is the average cost of a data breach per incident. of breaches
Gladiator Incident Alert
Gladiator Incident Alert Allen Eaves Sabastian Fazzino FINANCIAL PERFORMANCE RETAIL DELIVERY IMAGING PAYMENT SOLUTIONS INFORMATION SECURITY & RISK MANAGEMENT ONLINE & MOBILE 1 2016 Jack Henry & Associates,
Computer Forensics: Investigating Network Intrusions and Cyber Crime, 2nd Edition. Chapter 3 Investigating Web Attacks
Computer Forensics: Investigating Network Intrusions and Cyber Crime, 2nd Edition Chapter 3 Investigating Web Attacks Objectives After completing this chapter, you should be able to: Recognize the indications
The Kill Chain for the Advanced Persistent Threat
The Kill Chain for the Advanced Persistent Threat Intelligence-driven Computer Network Defense as presented at Michael Cloppert Eric Hutchins Lockheed Martin Corp Wednesday, October 12, 2011 0000 10/12/2011
THE SIX ESSENTIAL CAPABILITIES OF AN ANALYTICS-DRIVEN SIEM
THE SIX ESSENTIAL CAPABILITIES OF AN ANALYTICS-DRIVEN SIEM Modern threats demand analytics-driven security and continuous monitoring Legacy SIEMs are Stuck in the Past Finding a mechanism to collect, store
Best Practices for Scoping Infections and Disrupting Breaches
2017 SPLUNK INC. Best Practices for Scoping Infections and Disrupting Breaches Analytics-Driven Security Alain Gutknecht Staff SE alain@splunk.com 2017 SPLUNK INC. The Ever-Changing Threat Landscape 100%
STANDARD INFORMATION SHARING FORMATS. Will Semple Head of Threat and Vulnerability Management New York Stock Exchange
STANDARD INFORMATION SHARING FORMATS Will Semple Head of Threat and Vulnerability Management New York Stock Exchange AGENDA Information Sharing from the Practitioner s view Changing the focus from Risk
QuickSpecs. Aruba IntroSpect User and Entity Behavior Analytics. Overview. Aruba IntroSpect User and Entity Behavior Analytics Product overview
Overview Product overview Aruba s User and Entity Behavior Analytics (UEBA) solution, Aruba IntroSpect, detects attacks by spotting small changes in behavior that are often indicative of attacks that have
Security analytics: From data to action Visual and analytical approaches to detecting modern adversaries
Security analytics: From data to action Visual and analytical approaches to detecting modern adversaries Chris Calvert, CISSP, CISM Director of Solutions Innovation Copyright 2013 Hewlett-Packard Development
Let s Talk About Threat Intelligence
Let s Talk About Threat Intelligence IBM SECURITY SUPPORT OPEN MIC #20 Slides and additional dial in numbers: http://ibm.biz/openmic20 January 26, 2017 NOTICE: BY PARTICIPATING IN THIS CALL, YOU GIVE YOUR
Sharing What Matters. Accelerating Incident Response and Threat Hunting by Sharing Behavioral Data
Sharing What Matters Accelerating Incident Response and Threat Hunting by Sharing Behavioral Data Dan Gunter, Principal Threat Analyst Marc Seitz, Threat Analyst Dragos, Inc. August 2018 Today s Talk at