Bolster Your IR Program. Eric Sun, Solutions Mgr, Incident Detection &
|
|
|
- Eleanore Rice
- 5 years ago
- Views:
Transcription
1 Bolster Your IR Program Eric Sun, Solutions Mgr, Incident Detection &
2 What is the Attack Chain, and why map to it? Today s state of Incident Detection & Response Rapid7 approach to Investigations
3 Solutions Manager Incident Detection & Behavior analytics / risk management background Custom enterprise mobile app development Zco Corporation
4
5 Graphical representation of steps required to breach a company Applies across entire range of attacks Credential-based attacks Malware Vulnerability exploitation Detecting earlier in the chain = no chance for data exfiltration
6 Poker story: How much you bluff? Sharks Attack the right target Analyze behavior to find weakness Attackers Monetizable data + immature What s worked before? IR Program: Compare against attacker maturity, not similar sized orgs
7 Infiltration and Persistence Phish users Use leaked credentials Connect to network Anonymize access Deploy backdoors Explore Network Get user list Scout targets Find vulnerabilities Lateral Movement Access machines with credentials Collect more passwords Increase privileges Mission Target Access critical data Upload data to external location Maintain Presence Deploy backdoors Continued checkins for future use
8 Infiltration and Persistence Phish users Use leaked credentials Connect to network Anonymize access Deploy backdoors Mission Target Access critical data Upload data to external location
9 Unified Network Coverage (Step 1) Attacker Recon (Step 2) Compromised Creds (Step 3) Cloud services Remote workers Network scans Password guessing attempts Cannot detect with threat intel Present in 63% of confirmed data breaches* *2016 Verizon Data Breach Investigations Report 9
10
11 1. Collected in Nov 2015: 271 Security Professionals Questions, mins to complete 86% completion 3. LinkedIn, Twitter, R7 Community, Rapid7 Staff 4. Findings Report & Apple Watch
12 49% 26% 26% 12
13 13
14 1. Security Information & Event Management: Deploying and maintaining SIEM 2. Reducing Attack Surface: Pen testing, vuln management, web app scanning 3. Firewall: Tuning, replacing, and deploying next-gen solutions
15 Do you use one? (poll) Primary drivers: Incident Detection Compliance Log Search How are they useful? What is being monitored?
16 Confidential and Proprietary 16
17 17
18 Security teams are strained Too many alerts Investigations take too long Limited resources; gaps in coverage 62% orgs receiving more alerts than they can investigate Time-consuming to validate; jumping between multiple tools 18
19
20 UNIFY Combine SIEM, UBA, and EDR to leave attackers with nowhere to hide. DETECT Find unknown threats with User Behavior Analytics and Deception Technology. PRIORITIZE Know exactly where to search with Security Analytics.
21 Is this alert real, or a false positive? Who was impacted? What were the users doing? Did this happen to anyone else? Gather findings. Create & share Super Timeline. Use experience and context to decide. Retrace IP Addresses to the Users Behind Them Review authentication logs; Query endpoint; Run forensics on machine Search across log data; Run a hunt Combine data across log search, user activity, and endpoint artifacts Log Files (e.g. Event, AntiVirus, Firewall, Proxy) Endpoint Agent Enriched Log Search User Behavior SIEM/Log Aggregator User Behavior Analytics Brings together: Endpoint Data
22
23 Confidential and Proprietary 23
24
25
26 INVESTIGATION DETAILS
27
28
29 Deep Broad
30
31
32
33
34
35
36
37
38
39
40
41 I like the log search and the ability to bring in logs from anywhere. Not just from supported sources, but any source. Chad Kliewer Information Security Officer When you compare it to our previous method of manually going through logs, it s reduced investigation time by roughly 85 percent. Russ Swift Information Security Manager Incident detection and investigation has always been a cumbersome, manual process. With InsightIDR all the information I need to understand and solve a problem is at my fingertips. Jordan Schroeder Security Architect InsightIDR is a great system. It gives you that warm feeling inside by catching any suspicious behavior on the network months before you d otherwise discover it Tom Brown IT Manager InsightIDR arms my team of incident investigators with the exact information they need to make smarter decisions. Fortune 500 Real Estate Investment Trust
42 1. Focus on earlier detection in the chain 2. Avoid duplications per step to maximize investments 3. Identify current gaps in your program 4. Prioritize high-probability attacks (e.g. creds)
43 Eric
44
45 InsightIDR Solution Architecture Network Events Remote Endpoints Real-Time Endpoint Events Intruder Traps On-Premise Insight Collectors SSL SSL InsightIDR Attacker Analytics Platform Security Team Applications User Behavior Analytics Machine Learning Fully Searchable Data Set Existing Security Solutions, Alerts, and Events Enterprise Cloud Apps Mobile Devices 45
46 Insight Platform Supported Event Sources FOUNDATION EVENT SOURCES LDAP Microsoft Active Directory LDAP Active Directory Microsoft DHCP Alcatel-Lucent VitalQIP Bluecat Cisco ios Cisco Meraki Infoblox Trinzic ISC dhcpd Microsoft MicroTik SophosUTM VALUE-ADD EVENT SOURCES DNS VPN IDS / IPS Web Proxy Firewall Servers Security Console Enterprise Cloud Applications Intruder Traps 46
47 DNS ISC Bind9 Infoblox Trinzic Microsoft DNS MikroTik PowerDNS Data Exporters FireEye Threat Analytics Platform HP ArcSight & ArcSight Logger Splunk VPN Barracuda NG Cisco ASA Citrix NetScaler F5 Networks FirePass Fortinet FortiGate Juniper SA Microsoft IAS (RADIUS) Microsoft Network Policy Server Microsoft Remote Web Access MobilityGuard OneGate OpenVPN SonicWALL VMware Horizon WatchGuard XTM Web Proxy Barracuda Web Filter Blue Coat Cisco IronPort Fortinet FortiGate Intel Security (fka McAfee) Web Reporter McAfee Web Reporter Sophos Secure Web Gateway Squid TrendMicro Control Manager Watchguard XTM WebSense Web Security Gateway Zscalar NSS & ActiveSync Microsoft Exchange Transport Agent ( monitoring) OWA/ActiveSync (Ingress monitoring, mobile device attribution) Firewall Barracuda NG Cisco ASA & VPN Cisco IOS Cisco Meraki Check Point Clavister W20 Fortinet Fortigate Juniper Junos OS Juniper Netscreen McAfee Palo Alto Networks & VPN pfsense SonicWALL Sophos Stonesoft Watchguard XTM IDS / IPS Cisco Sourcefire Dell isensor Dell SonicWall HP TippingPoint McAfee IDS Metaflows IDS Security Onion Snort Rapid7 Windows Agentless Endpoint Monitor Mac Agentless Endpoint Monitor Honeypot & Honey Users Metasploit Nexpose Sophos Enduser Protection Symantec Endpoint Protection Cloud Services Microsoft Office 365 AWS Cloud Trails Box.com Duo Security Google Apps Okta Salesforce.com Advanced Malware FireEye NX Palo Alto Networks WildFire SIEMs/Log Aggregators HP ArcSight IBM QRadar Intel Security (fka McAfee) NitroSecurity LogRhythm Splunk Virus Scanners Cylance Protect Check Point AV F-Secure McAfee epo Sophos Symantec Enduser Protection TrendMicro OfficeScan TrendMicro Control Manager Application Monitoring Atlassian Confluence Microsoft SQL Server Insight Platform Event Sources Cont. 47
Prevention vs Detection - Come ribilanciare gli investimenti sulla sicurezza IT. Manuel Minzoni Business developer Itway
Prevention vs Detection - Come ribilanciare gli investimenti sulla sicurezza IT Manuel Minzoni Business developer Itway NASDAQ: RPD Delivering Security Data & Analytics that revolutionize the practice
Automated Response in Cyber Security SOC with Actionable Threat Intelligence
Automated Response in Cyber Security SOC with Actionable Threat Intelligence while its biggest weakness is lack of visibility: SOCs still can t detect previously unknown threats, which is a consistent
SecureVue. Version Supported Technologies List Updated: July 2015
SecureVue Version 3.6.7.4 Supported Technologies List Updated: July 2015 SecureVue The following table provides a detailed list of all network devices, security devices, hosts, applications, and databases
Keeping your VPN protected
Keeping your VPN protected Overview The increasing use of remote access is driving businesses to look for an easy to manage, secure solution for providing access to sensitive company assets. To meet that
Mcafee Network Intrusion Detection System. Project Report >>>CLICK HERE<<<
Mcafee Network Intrusion Detection System Project Report Selecting an intrusion detection and prevention system vendor can be a IDS/IPS protection, the current network configuration and the project budget,
Keeping your VPN protected. proven. trusted.
Keeping your VPN protected proven. trusted. Overview The increasing use of remote access is driving businesses to look for an easy to manage, secure solution for providing access to sensitive company assets.
Building Resilience in a Digital Enterprise
Building Resilience in a Digital Enterprise Top five steps to help reduce the risk of advanced targeted attacks To be successful in business today, an enterprise must operate securely in the cyberdomain.
Zix Support for Standards
COMPATABILITY GUIDE Zix works in your environment because our products are based in standards such as SMTP, SAML and OATH. We have thousands of customers using Zix in diverse environments, and we know
Leveraging Open-Source Intelligence (OSINT)
Leveraging Open-Source Intelligence (OSINT) How Social Footprints Lead to Cyber Risk Chris Coryea International Cyber Intelligence Services Manager 2017 LEIDOS. ALL RIGHTS RESERVED. The wording LEIDOS
Protecting Against Modern Attacks. Protection Against Modern Attack Vectors
Protecting Against Modern Attacks Protection Against Modern Attack Vectors CYBER SECURITY IS A CEO ISSUE. - M C K I N S E Y $4.0M 81% >300K 87% is the average cost of a data breach per incident. of breaches
Infoblox as Part of the Ecosystem
Infoblox Core Exchange Infoblox Core Exchange is a highly-interconnected set of ecosystem integrations that extend security, increase agility, and provide situational awareness for more efficient operations,
HPE Security ArcSight Connectors
HPE Security ArcSight Connectors SmartConnector Release Notes 7.6.0.8009.0 May 15, 2017 HPE Security ArcSight SmartConnector Release Notes 7.6.0.8009.0 May 15, 2017 Copyright 2010 2017 Hewlett Packard
KASPERSKY ENDPOINT SECURITY FOR BUSINESS
KASPERSKY ENDPOINT SECURITY FOR BUSINESS 1 WHAT WE SEE TODAY 325,000 New Endpoint Threats per day Targeted attacks and malware campaigns Threat reports Continued Exploitation of Vulnerabilities in 3rd
HPE Security ArcSight Connectors
HPE Security ArcSight Connectors SmartConnector Parser Update Release Notes 7.6.2.8023.0 July 14, 2017 HPE Security ArcSight SmartConnector Parser Update Release Notes 7.6.2.8023.0 July 14, 2017 Copyright
THE RSA SUITE NETWITNESS REINVENT YOUR SIEM. Presented by: Walter Abeson
THE RSA NETWITNESS SUITE REINVENT YOUR SIEM Presented by: Walter Abeson 1 Reality Goals GOALS VERSUS REALITY OF SIEM 1.0 Single compliance & security interface Analyze & prioritize alerts across various
QuickSpecs. Aruba IntroSpect User and Entity Behavior Analytics. Overview. Aruba IntroSpect User and Entity Behavior Analytics Product overview
Overview Product overview Aruba s User and Entity Behavior Analytics (UEBA) solution, Aruba IntroSpect, detects attacks by spotting small changes in behavior that are often indicative of attacks that have
THE ACCENTURE CYBER DEFENSE SOLUTION
THE ACCENTURE CYBER DEFENSE SOLUTION A MANAGED SERVICE FOR CYBER DEFENSE FROM ACCENTURE AND SPLUNK. YOUR CURRENT APPROACHES TO CYBER DEFENSE COULD BE PUTTING YOU AT RISK Cyber-attacks are increasingly
SentinelOne Technical Brief
SentinelOne Technical Brief SentinelOne unifies prevention, detection and response in a fundamentally new approach to endpoint protection, driven by behavior-based threat detection and intelligent automation.
Compare Security Analytics Solutions
Compare Security Analytics Solutions Learn how Cisco Stealthwatch compares with other security analytics products. This solution scales easily, giving you visibility across the entire network. Stealthwatch
The SANS Institute Top 20 Critical Security Controls. Compliance Guide
The SANS Institute Top 20 Critical Security Controls Compliance Guide February 2014 The Need for a Risk-Based Approach A common factor across many recent security breaches is that the targeted enterprise
Gladiator Incident Alert
Gladiator Incident Alert Allen Eaves Sabastian Fazzino FINANCIAL PERFORMANCE RETAIL DELIVERY IMAGING PAYMENT SOLUTIONS INFORMATION SECURITY & RISK MANAGEMENT ONLINE & MOBILE 1 2016 Jack Henry & Associates,
Joe Stocker, CISSP, MCITP, VTSP Patriot Consulting
Joe Stocker, CISSP, MCITP, VTSP Patriot Consulting Microsoft Cloud Evangelist at Patriot Consulting Principal Systems Architect with 17 Years of experience Technical certifications: MCSE, MCITP Office
Traditional Security Solutions Have Reached Their Limit
Traditional Security Solutions Have Reached Their Limit CHALLENGE #1 They are reactive They force you to deal only with symptoms, rather than root causes. CHALLENGE #2 256 DAYS TO IDENTIFY A BREACH TRADITIONAL
Integrated, Intelligence driven Cyber Threat Hunting
Integrated, Intelligence driven Cyber Threat Hunting THREAT INVESTIGATION AND RESPONSE PLATFORM Zsolt Kocsis IBM Security Technical Executive, CEE zsolt.kocsis@hu.ibm.com 6th Nov 2018 Build an integrated
ATTIVO NETWORKS THREATDEFEND PLATFORM INTEGRATION WITH CISCO SYSTEMS PROTECTS THE NETWORK
PARTNER BRIEF ATTIVO NETWORKS THREATDEFEND PLATFORM INTEGRATION WITH CISCO SYSTEMS PROTECTS THE NETWORK INTRODUCTION Attivo Networks has partnered with Cisco Systems to provide advanced real-time inside-the-network
Enhancing the Cybersecurity of Federal Information and Assets through CSIP
TECH BRIEF How BeyondTrust Helps Government Agencies Address Privileged Access Management to Improve Security Contents Introduction... 2 Achieving CSIP Objectives... 2 Steps to improve protection... 3
Cybersecurity Roadmap: Global Healthcare Security Architecture
SESSION ID: TECH-W02F Cybersecurity Roadmap: Global Healthcare Security Architecture Nick H. Yoo Chief Security Architect Disclosure No affiliation to any vendor products No vendor endorsements Products
SANS Top 20 CIS. Critical Security Control Solution Brief Version 6. SANS Top 20 CIS. EventTracker 8815 Centre Park Drive, Columbia MD 21045
Critical Security Control Solution Brief Version 6 8815 Centre Park Drive, Columbia MD 21045 About delivers business critical software and services that transform high-volume cryptic log data into actionable,
Key Technologies for Security Operations. Copyright 2014 EMC Corporation. All rights reserved.
Key Technologies for Security Operations 2 Traditional Security Is Not Working 97% of breaches led to compromise within days or less with 72% leading to data exfiltration in the same time Source: Verizon
NIST Special Publication
DATASHEET NIST Special Publication 800-53 Security and Privacy Controls for Federal Information Systems and Organizations Mapping for Carbon Black BACKGROUND The National Institute of Standards and Technology
Introduction to Threat Deception for Modern Cyber Warfare
Introduction to Threat Deception for Modern Cyber Warfare Joseph R. Salazar Technical Deception Engineer CISSP, CEH, EnCE 1 Introduction AGENDA Attacker Playbook The Need for Deception Deception as Detection
Reducing the Cost of Incident Response
Reducing the Cost of Incident Response Introduction Cb Response is the most complete endpoint detection and response solution available to security teams who want a single platform for hunting threats,
WHITEPAPER ATTIVO NETWORKS THREATDEFEND PLATFORM AND THE MITRE ATT&CK MATRIX
WHITEPAPER ATTIVO NETWORKS THREATDEFEND PLATFORM AND THE MITRE ATT&CK MATRIX 1 INTRODUCTION The MITRE Corporation Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK ) Matrix provides a model
Behavioral Analytics A Closer Look
SESSION ID: GPS2-F03 Behavioral Analytics A Closer Look Mike Huckaby VP, Global Systems Engineering RSA The world is full of obvious things which nobody by any chance ever observes. Sherlock Holmes 2 Patterns
Designing and Building a Cybersecurity Program
Designing and Building a Cybersecurity Program Based on the NIST Cybersecurity Framework (CSF) Larry Wilson lwilson@umassp.edu ISACA Breakfast Meeting January, 2016 Designing & Building a Cybersecurity
Security Monitoring. Managed Vulnerability Services. Managed Endpoint Protection. Platform. Platform Managed Endpoint Detection and Response
Security Operations Flexible and Scalable Solutions to Improve Your Security Capabilities Security threats continue to rise each year and are increasing in sophistication and malicious intent. Unfortunately,
Security Made Simple by Sophos
Security Made Simple by Sophos Indian businesses in the radar of cyber-threats Frequency of cyber-attacks Most targeted systems / IT assets -- KPMG Cybercrime Survey Report 2015 3 ON AN AVERAGE, HOW MUCH
RSA NetWitness Suite Respond in Minutes, Not Months
RSA NetWitness Suite Respond in Minutes, Not Months Overview One can hardly pick up a newspaper or turn on the news without hearing about the latest security breaches. The Verizon 2015 Data Breach Investigations
Proactive Approach to Cyber Security
Proactive roach to Cyber Security Jeffrey Neo Sales Director HP Enterprise Security Products Customers struggle to manage the security challenge Today, security is a board-level agenda item 2 Trends driving
Symantec Endpoint Protection Family Feature Comparison
Symantec Endpoint Protection Family Feature Comparison SEP SBE SEP Cloud SEP Cloud SEP 14.2 Device Protection Laptop, Laptop Laptop, Tablet Laptop Tablet & & Smartphone Smartphone Meter Per Device Per
SentinelOne Technical Brief
SentinelOne Technical Brief SentinelOne unifies prevention, detection and response in a fundamentally new approach to endpoint protection, driven by machine learning and intelligent automation. By rethinking
A Risk Management Platform
A Risk Management Platform Michael Lai CISSP, CISA, MBA, MSc, BEng(hons) Territory Manager & Senior Security Sales Engineer Shift to Risk-Based Security OLD MODEL: Prevention-Based Security Prevention
Technology Incident Response and Impact Reduction. May 9, David Litton
Technology Incident Response and Impact Reduction May 9, 2018 David Litton dmlitton@vcu.edu Incidents and Impacts Yahoo! EQUIFAX MedStar Dyn, Inc. Stolen Data Destroyed Data Lost Service / Availability
Incident Response Agility: Leverage the Past and Present into the Future
SESSION ID: SPO1-W03 Incident Response Agility: Leverage the Past and Present into the Future Torry Campbell CTO, Endpoint and Management Technologies Intel Security The Reality we Face Reconnaissance
Copyright 2011 Trend Micro Inc.
Copyright 2011 Trend Micro Inc. 2008Q1 2008Q2 2008Q3 2008Q4 2009Q1 2009Q2 2009Q3 2009Q4 2010Q1 2010Q2 2010Q3 2010Q4 2011Q1 2011Q2 2011Q3 2011Q4 M'JPY Cloud Security revenue Q to Q Growth DeepSecurity/Hosted/CPVM/IDF
SOLUTION BRIEF RSA NETWITNESS EVOLVED SIEM
RSA NETWITNESS EVOLVED SIEM OVERVIEW A SIEM is technology originally intended for compliance and log management. Later, as SIEMs became the aggregation points for security alerts, they began to be more
USM Anywhere AlienApps Guide
USM Anywhere AlienApps Guide Updated April 23, 2018 Copyright 2018 AlienVault. All rights reserved. AlienVault, AlienApp, AlienApps, AlienVault OSSIM, Open Threat Exchange, OTX, Unified Security Management,
Stopping Advanced Persistent Threats In Cloud and DataCenters
Stopping Advanced Persistent Threats In Cloud and DataCenters Frederik Van Roosendael PSE Belgium Luxembourg 10/9/2015 Copyright 2013 Trend Micro Inc. Agenda How Threats evolved Transforming Your Data
Security Market Intelligence: Security Risks, Compliance Challenges Fuel Security Spend
Security Market Intelligence: Security Risks, Compliance Challenges Fuel Security Spend Robert Westervelt IDC Data Security Practice rwestervelt@idc.com 508.935.4331 Twitter.com/rwestervelt Talking Points
Seceon s Open Threat Management software
Seceon s Open Threat Management software Seceon s Open Threat Management software (OTM), is a cyber-security advanced threat management platform that visualizes, detects, and eliminates threats in real
SYMANTEC DATA CENTER SECURITY
SYMANTEC DATA CENTER SECURITY SYMANTEC UNIFIED SECURITY STRATEGY Users Cyber Security Services Monitoring, Incident Response, Simulation, Adversary Threat Intelligence Data Threat Protection Information
Threat Containment and Operations. Yong Kwang Kek, Director of Presales SE, APJ
Threat Containment and Operations Yong Kwang Kek, Director of Presales SE, APJ 2018-07-19 1 1 2017 Infoblox Inc. All Rights 2013 Infoblox Inc. All Reserved. Rights Reserved. Three Aspects of Security #1
Datacenter Security: Protection Beyond OS LifeCycle
Section Datacenter Security: Protection Beyond OS LifeCycle 1 Not so fun Facts from the Symantec ISTR 2017 Report Zero-Day Vulnerability, annual total Legitimate tools, annual total 6,000 5 5,000 4,000
the SWIFT Customer Security
TECH BRIEF Mapping BeyondTrust Solutions to the SWIFT Customer Security Controls Framework Privileged Access Management and Vulnerability Management Table of ContentsTable of Contents... 2 Purpose of This
how dtex fights insider threats
how dtex fights insider threats Over the past several years, organizations have begun putting more and more focus on the end user. But security teams are quickly realizing that tools like traditional UBA
Prescriptive Security Operations Centers. Leveraging big data capabilities to build next generation SOC
Prescriptive Security Operations Centers Leveraging big data capabilities to build next generation SOC Cyber Security Industry in constant renewal in 2016 and 2017 1 Tbps Mirai IoT Botnet broke the Internet
Who am I? Identity Product Group, CXP Team. Premier Field Engineer. SANS STI Student GWAPT, GCIA, GCIH, GCWN, GMOB
@markmorow Who am I? Identity Product Group, CXP Team Premier Field Engineer SANS STI Student GWAPT, GCIA, GCIH, GCWN, GMOB Active Directory Domain Services On-premises App Server Validate credentials
Defense-in-Depth Against Malicious Software. Speaker name Title Group Microsoft Corporation
Defense-in-Depth Against Malicious Software Speaker name Title Group Microsoft Corporation Agenda Understanding the Characteristics of Malicious Software Malware Defense-in-Depth Malware Defense for Client
Not your Father s SIEM
Not your Father s SIEM Getting Better Insights & Results Bill Thorn Director, Security Operations Apollo Education Group Agenda Why use a SIEM? What is a SIEM? Benefits of Using a SIEM Considerations Before
RSA Security Analytics
RSA Security Analytics This is what SIEM was Meant to Be 1 The Original Intent of SIEM Single compliance & security interface Analyze & prioritize alerts across various sources The cornerstone of security
Un SOC avanzato per una efficace risposta al cybercrime
Un SOC avanzato per una efficace risposta al cybercrime Identificazione e conferma di un incidente @RSAEMEA #RSAEMEASummit @masiste75 Mauro Costantini - Presales Consultant Agenda A look into the threat
Symantec Advanced Threat Protection: Endpoint
Symantec Advanced Threat Protection: Endpoint Data Sheet: Advanced Threat Protection The Problem Virtually all of today's advanced persistent threats leverage endpoint systems in order to infiltrate their
CYBER RISK MANAGEMENT: ADDRESSING THE CHALLENGE SIMON CRUMPLIN, FOUNDER & CEO
CYBER RISK MANAGEMENT: ADDRESSING THE CHALLENGE SIMON CRUMPLIN, FOUNDER & CEO INFORMATION SECURITY PAINS CISO RESPONSIBILITY WITHOUT AUTHORITY INVENTORY TO MANAGE ALERTS WITHOUT MEANING ASSETS SPREAD ACROSS
Put an end to cyberthreats
Put an end to cyberthreats Automated and centralized Advanced Security CORPORATE CYBERSECURITY Who is behind cyberthreats?1 73% 28% 12% 50% What is the cost to companies? Global cost: $600,000 M3 Cost
Security+ SY0-501 Study Guide Table of Contents
Security+ SY0-501 Study Guide Table of Contents Course Introduction Table of Contents About This Course About CompTIA Certifications Module 1 / Threats, Attacks, and Vulnerabilities Module 1 / Unit 1 Indicators
PrecisionAccess Trusted Access Control
Data Sheet PrecisionAccess Trusted Access Control Defeats Cyber Attacks Credential Theft: Integrated MFA defeats credential theft. Server Exploitation: Server isolation defeats server exploitation. Compromised
68 Insider Threat Red Flags
68 Insider Threat Red Flags Are you prepared to stop the insider threat? Enterprises of all shapes and sizes are taking a fresh look at their insider threat programs. As a company that s been in the insider
Building a Threat-Based Cyber Team
Building a Threat-Based Cyber Team Anthony Talamantes Manager, Defensive Cyber Operations Todd Kight Lead Cyber Threat Analyst Sep 26, 2017 Washington, DC Forward-Looking Statements During the course of
Getting over Ransomware - Plan your Strategy for more Advanced Threats
Getting over Ransomware - Plan your Strategy for more Advanced Threats Kaspersky Lab Hong Kong Eric Kwok General Manager Lapcom Ltd. BEYOND ANTI-VIRUS: TRUE CYBERSECURITY FROM KASPERSKY LAB 20 years ago
THE SIX ESSENTIAL CAPABILITIES OF AN ANALYTICS-DRIVEN SIEM
THE SIX ESSENTIAL CAPABILITIES OF AN ANALYTICS-DRIVEN SIEM Modern threats demand analytics-driven security and continuous monitoring Legacy SIEMs are Stuck in the Past Finding a mechanism to collect, store
Managed Endpoint Defense
DATA SHEET Managed Endpoint Defense Powered by CB Defense Next-gen endpoint threat detection and response DEPLOY AND HARDEN. Rapidly deploy and optimize endpoint prevention with dedicated security experts
Who am I? Identity Product Group, CXP Team. Premier Field Engineer. SANS STI Student GWAPT, GCIA, GCIH, GCWN, GMOB
@markmorow Who am I? Identity Product Group, CXP Team Premier Field Engineer SANS STI Student GWAPT, GCIA, GCIH, GCWN, GMOB Under the hood: Multiple backend services and hybrid components Hybrid Components
RULES VERSUS MODELS IN YOUR SIEM
WHITE PAPER RULES VERSUS MODELS IN YOUR SIEM INTRODUCTION There has been a rapid increase in malicious insider threats, compromised insiders, and sensitive data exfiltration targeting enterprises today.
CloudSOC and Security.cloud for Microsoft Office 365
Solution Brief CloudSOC and Email Security.cloud for Microsoft Office 365 DID YOU KNOW? Email is the #1 delivery mechanism for malware. 1 Over 40% of compliance related data in Office 365 is overexposed
Surprisingly Successful: What Really Works in Cyber Defense. John Pescatore, SANS
Surprisingly Successful: What Really Works in Cyber Defense John Pescatore, SANS 1 Largest Breach Ever 2 The Business Impact Equation All CEOs know stuff happens in business and in security The goal is
10 KEY WAYS THE FINANCIAL SERVICES INDUSTRY CAN COMBAT CYBER THREATS
10 KEY WAYS THE FINANCIAL SERVICES INDUSTRY CAN COMBAT CYBER THREATS WHITE PAPER INTRODUCTION BANKS ARE A COMMON TARGET FOR CYBER CRIMINALS AND OVER THE LAST YEAR, FIREEYE HAS BEEN HELPING CUSTOMERS RESPOND
Part 2: How to Detect Insider Threats
Part 2: How to Detect Insider Threats Amichai Shulman Chief Technology Officer Imperva Amichai Shulman CTO, Imperva Speaker at Industry Events RSA, Appsec, Info Security UK, Black Hat Lecturer on information
MCAFEE INTEGRATED THREAT DEFENSE SOLUTION
IDC Lab Validation Report, Executive Summary MCAFEE INTEGRATED THREAT DEFENSE SOLUTION Essential Capabilities for Analyzing and Protecting Against Advanced Threats By Rob Ayoub, CISSP, IDC Security Products
BOLSTERING DETECTION ABILITIES KENT KNUDSEN JUNE 23, 2016
BOLSTERING DETECTION ABILITIES KENT KNUDSEN JUNE 23, 2016 Overview Current Threats Where we fail Cyber Security Lifecycle Key Areas to Continuously Monitor Security Metrics Where to prioritize Security
Pluralsight CEU-Eligible Courses for CompTIA Network+ updated March 2018
Pluralsight CEU-Eligible Courses for CompTIA Network+ updated March 2018 Access Control Lists (ACLs) for Cisco CCNA 200-125/100-105 Advanced Access Control with Cisco ISE for CCNP Security (300-208) SISAS
SOLUTION BRIEF RSA NETWITNESS SUITE 3X THE IMPACT WITH YOUR EXISTING SECURITY TEAM
SOLUTION BRIEF RSA NETWITNESS SUITE 3X THE IMPACT WITH YOUR EXISTING SECURITY TEAM OVERVIEW The Verizon 2016 Data Breach Investigations Report highlights that attackers are regularly outpacing the defenders.
NOTHING IS WHAT IT SIEMs: COVER PAGE. Simpler Way to Effective Threat Management TEMPLATE. Dan Pitman Principal Security Architect
NOTHING IS WHAT IT SIEMs: COVER PAGE Simpler Way to Effective Threat Management TEMPLATE Dan Pitman Principal Security Architect Cybersecurity is harder than it should be 2 SIEM can be harder than it should
ISO COMPLIANCE GUIDE. How Rapid7 Can Help You Achieve Compliance with ISO 27002
ISO 27002 COMPLIANCE GUIDE How Rapid7 Can Help You Achieve Compliance with ISO 27002 A CONTENTS Introduction 2 Detailed Controls Mapping 3 About Rapid7 8 rapid7.com ISO 27002 Compliance Guide 1 INTRODUCTION
Fidelis Overview. ISC 2 DoD and Industry Forum. Rapid Detection and Automated Incident Response DoD & Commercial Active Defense Use Cases
Fidelis Overview ISC 2 DoD and Industry Forum Rapid Detection and Automated Incident Response DoD & Commercial Active Defense Use Cases Vince Holtmann-Cyber Subject Matter Expert Vincent.Holtmann@fidelissecurity.com
Cognito Detect is the most powerful way to find and stop cyberattackers in real time
Overview Cognito Detect is the most powerful way to find and stop cyberattackers in real time HIGHLIGHTS Always-learning behavioral models use AI to find hidden and unknown attackers, enable quick, decisive
Novetta Cyber Analytics
Know your network. Arm your analysts. Introduction Novetta Cyber Analytics is an advanced network traffic analytics solution that empowers analysts with comprehensive, near real time cyber security visibility
AWS VPC Cloud Environment Setup
AWS VPC Cloud Environment Setup Table of Contents Introduction 3 Requirements 5 Step 1: VPC Deployment Setup 10 Step 2: Launching a VNS3 Controller 15 Instance VNS3 Configuration Document Links 19 2 Introduction
WHITEPAPER ATTIVO NETWORKS DECEPTION TECHNOLOGY FOR MERGERS AND ACQUISITIONS
WHITEPAPER ATTIVO NETWORKS DECEPTION TECHNOLOGY FOR MERGERS AND ACQUISITIONS 1 INTRODUCTION Mergers & Acquisitions (M&A) are undertaken for a variety of strategic reasons that aim for greater synergy,
McAfee epolicy Orchestrator
McAfee epolicy Orchestrator Centrally get, visualize, share, and act on security insights Security management requires cumbersome juggling between tools and data. This puts the adversary at an advantage
DATA SHEET RISK & CYBERSECURITY PRACTICE EMPOWERING CUSTOMERS TO TAKE COMMAND OF THEIR EVOLVING RISK & CYBERSECURITY POSTURE
DATA SHEET RISK & CYBERSECURITY PRACTICE EMPOWERING CUSTOMERS TO TAKE COMMAND OF THEIR EVOLVING RISK & CYBERSECURITY POSTURE EXECUTIVE SUMMARY ALIGNING CYBERSECURITY WITH RISK The agility and cost efficiencies
The Cognito automated threat detection and response platform
Overview The Cognito automated threat detection and response platform HIGHLIGHTS Finds active cyberattackers inside cloud, data center and enterprise environments Automates security investigations with
Tanium Connect User Guide. Version 4.8.3
Tanium Connect User Guide Version 4.8.3 September 11, 2018 The information in this document is subject to change without notice. Further, the information provided in this document is provided as is and
SECURITY SERVICES SECURITY
SECURITY SERVICES SECURITY SOLUTION SUMMARY Computacenter helps organisations safeguard data, simplify compliance and enable users with holistic security solutions With users, data and devices dispersed
McAfee Skyhigh Security Cloud for Citrix ShareFile
McAfee Skyhigh Security Cloud for Citrix ShareFile McAfee Skyhigh Security Cloud for Citrix ShareFile helps organizations securely accelerate their business by providing industry-best Data Loss Prevention
SIEM: Five Requirements that Solve the Bigger Business Issues
SIEM: Five Requirements that Solve the Bigger Business Issues After more than a decade functioning in production environments, security information and event management (SIEM) solutions are now considered
Best Practices for Scoping Infections and Disrupting Breaches
2017 SPLUNK INC. Best Practices for Scoping Infections and Disrupting Breaches Analytics-Driven Security Alain Gutknecht Staff SE alain@splunk.com 2017 SPLUNK INC. The Ever-Changing Threat Landscape 100%
Symantec & Blue Coat Technical Update Webinar 29. Juni 2017
Avantec Blue Coat/Symantec Webinar Jean Marc Edder Senior Systems Engineer The Global Leader in Cyber Network + + Cloud Global market leader in Endpoint, Email, Data Loss Prevention and Website, User Authentication
Security Automation. Challenge: Automatizzare le azioni di isolamento e contenimento delle minacce rilevate tramite soluzioni di malware analysis
Security Automation Challenge: Automatizzare le azioni di isolamento e contenimento delle minacce rilevate tramite soluzioni di malware analysis Network Admission Control See Managed Unmanaged Computing
SIEM Product Comparison
SIEM Product Comparison SIEM Technology Space SIEM market analysis of the last 3 years suggest: Market consolidation of SIEM players (25 vendors in 2011 to 16 vendors in 2013) Only products with technology
SUBSTANTIAL TECHNOLOGY PARTNERSHIPS FOR YOUR SOLID SECURITY
SUBSTANTIAL TECHNOLOGY PARTNERSHIPS FOR YOUR SOLID SECURITY Connect reliable macmon Network Access Control (NAC) with leading security solutions and profit from real benefits! Our in-house developed NAC