Hunting Threats In your Enterprise
|
|
|
- Gordon Barrett
- 5 years ago
- Views:
Transcription
1 Hunting Threats In your Enterprise
2 ü Who am I? ü Abdulrahman Al-Nimari ü 25 Years IT & Infosec Experience ü Lead Enterprise Security Architect ü Mantech International Corporation, Riyadh, KSA ü CISSP, CISM, CCISO, PMP, GCIH, GCIA, GCUX, GREM, GSEC ü ü
3 ü Agenda ü What is Threat Hunting? ü Threat Hunting Plan ü Hunt Cycle ü Hunting in Action ü Hunt Maturity Level ü Measuring Success ( Metrics ) ü Resources Hunting Threats in Your Enterprise
4 Verizon Data Breach Investigations Report,
5 ü What is threat hunting? ücyber threat hunting is "the process of proactively and iteratively searching through networks to detect and isolate advanced threats that evade existing security solutions" ( Wikipedia ) ücyber threat hunting is the practice of searching iteratively through data to detect advanced threats that evade traditional security solutions ( sqrrl )
6 ü Threat Hunting Plan ü Design Your Network For Hunting ü Get your Team Ready ü Know your Enterprise ü Know Your Adversary TTP ü Collect Hunt Data ü Create Hypotheses ü Start Hunting
7 Hunting Threats in Your Enterprise Design Your Enterprise for Hunting Abdulrahman Al-Nimari BSides Conference, Dubai 27-28, November, 7
8 Hunting Threats in Your Enterprise Design Your Enterprise for Hunting Abdulrahman Al-Nimari BSides Conference, Dubai 27-28, November, 8
9 Design Your Enterprise for Hunting ü Segmentation : Security Zones ü NTP : Network Time Protocol ü Protection/Detection : FW/IDS/IPS/DLP/Proxy ü Tapping : Dump PCAP Data ü Visibility : Enable Logging as required
10 Hunting Threats in Your Enterprise ü Know Your Enterprise ü ü ü ü Identify Assets Know Threats to Your Assets Prioritize ( High Value / Critical Assets First ) Baselining Know what is normal? Abdulrahman Al-Nimari BSides Conference, Dubai 27-28, November,
11 Know Your Adversary - Cyber Kill Chain A cyber kill chain is a Lockheed Martin model that reveals the stages of a cyber attack from early reconnaissance to the goal of data exfiltration : Attacks in Planning Attacks in Progress Attacks already Happening
12 Know Your Adversary Mitre ATT&CK ATT&CK = Adversarial Tactics, Techniques, and Common Knowledge
13 Collect Hunt Data Data Domains : Network - Flow Data - NetFlow - PCAP - DNS - Proxy Logs - FW/SW/Routers Host - AV/EDR/FW - Windows/Sysmon Events - File System - Autoruns Application - Authentication - Transaction Logs - DB Logs - Security Alerts ü Log Data ü PCAP Data ü Netflow ü Threat Intelligence Data
14 Hunting Threats in Your Enterprise ü Threat Intelligence Feeds ( Open Source ) ü ü ü ü ü ü ü Abdulrahman Al-Nimari BSides Conference, Dubai 27-28, November,
15 Creating Hypothesis Hunting Threats in Your Enterprise Hypotheses Data ( Where to Hunt ) What to look for? Data Staging/Exfiltration? PCAPS, NetFlow Compressed Files Lateral Movement? PCAPS, Logs PSEXEC, Powershell Fileless Malware? PCAPS, NetFlow Powershell, WMI Command & Control (C2)? HTTP, Bro Logs MaliciousURLs/Domains/User agent/dns
16 Hunting Cycle Iterate aggressively through this cycle
17 Hunting Threats in Your Enterprise Hunting Maturity Model Abdulrahman Al-Nimari BSides Conference, Dubai 27-28, November,
18 Pyramid of Pain Hunting Threats in Your Enterprise HMM2,3,4 HMM1 HMM0
19 Hunting in Action #1 Malicious IP Address(es) Network Flow Internal IP Network Flow Anomaly Time Stamp Investigate PCAP/Logs
20 Hunting Threats in Your Enterprise Hunting in Action #2 Abdulrahman Al-Nimari BSides Conference, Dubai 27-28, November,
21 Hunting in Action #2 Hunting Threats in Your Enterprise Deploy autorunsc.exe to EP Collect Results in SIEM Compare to Baseline/VT Hash DB Anomalies Invistigate Automate
22 ü Measuring Success ( Metrics ) ü Number of Incidents by severity ü Number of Compromised Hosts ü Dwell Time of Incidents Discovered. ü Logging Gaps Identified and Corrected ü Vulnerabilities Identified ü Insecure Practices Identified and Corrected ü Hunts Transitioned to Analytics ü New Visibilities Gained
23 ü Resources ü ü ü ü ü ü ü ü
24 Q & A
25 Thank You
WHITEPAPER ATTIVO NETWORKS THREATDEFEND PLATFORM AND THE MITRE ATT&CK MATRIX
WHITEPAPER ATTIVO NETWORKS THREATDEFEND PLATFORM AND THE MITRE ATT&CK MATRIX 1 INTRODUCTION The MITRE Corporation Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK ) Matrix provides a model
Threat Hunting in Modern Networks. David Biser
Threat Hunting in Modern Networks David Biser What is Threat Hunting? The act of aggressively pursuing and eliminating cyber adversaries as early as possible in the Cyber Kill Chain. Why Perform Threat
SOLUTION BRIEF RSA NETWITNESS SUITE 3X THE IMPACT WITH YOUR EXISTING SECURITY TEAM
SOLUTION BRIEF RSA NETWITNESS SUITE 3X THE IMPACT WITH YOUR EXISTING SECURITY TEAM OVERVIEW The Verizon 2016 Data Breach Investigations Report highlights that attackers are regularly outpacing the defenders.
CTI Capability Maturity Model Marco Lourenco
1 CTI Capability Maturity Model Cyber Threat Intelligence Course NIS Summer School 2018, Crete October 2018 MARCO LOURENCO - ENISA Cyber Security Analyst Lead European Union Agency for Network and Information
Cyber Threat Intelligence Standards - A high-level overview
Cyber Threat Intelligence Standards - A high-level overview Christian Doerr TU Delft, Cyber Threat Intelligence Lab Delft University of Technology Challenge the future ~ whoami At TU Delft since 2008 in
OUTSMART ADVANCED CYBER ATTACKS WITH AN INTELLIGENCE-DRIVEN SECURITY OPERATIONS CENTER
OUTSMART ADVANCED CYBER ATTACKS WITH AN INTELLIGENCE-DRIVEN SECURITY OPERATIONS CENTER HOW TO ADDRESS GARTNER S FIVE CHARACTERISTICS OF AN INTELLIGENCE-DRIVEN SECURITY OPERATIONS CENTER 1 POWERING ACTIONABLE
Incident Response Agility: Leverage the Past and Present into the Future
SESSION ID: SPO1-W03 Incident Response Agility: Leverage the Past and Present into the Future Torry Campbell CTO, Endpoint and Management Technologies Intel Security The Reality we Face Reconnaissance
Reducing cyber risks in the era of digital transformation
Reducing cyber risks in the era of digital transformation Sergey Soldatov Head of Security Operations Center, R&D Security Services WHO AM I? Since 2016: Head of SOC at Kaspersky lab Internal SOC Commercial
4/13/2018. Certified Analyst Program Infosheet
4/13/2018 Certified Analyst Program Infosheet Contents I. Executive Summary II. Training Framework III. Course Structure, Learning Outcomes, and Skills List IV. Sign-up and More Information Executive Summary
Protecting Against Modern Attacks. Protection Against Modern Attack Vectors
Protecting Against Modern Attacks Protection Against Modern Attack Vectors CYBER SECURITY IS A CEO ISSUE. - M C K I N S E Y $4.0M 81% >300K 87% is the average cost of a data breach per incident. of breaches
Post-Exploitation Hunting with ATT&CK & Elastic
Post-Exploitation Hunting with ATT&CK & Elastic John Hubbard @SecHubb SOC Lead at GlaxoSmithKline SANS Author & Instructor SEC455: SIEM Design & Implementation SEC511: Continuous Monitoring & Security
Integrated, Intelligence driven Cyber Threat Hunting
Integrated, Intelligence driven Cyber Threat Hunting THREAT INVESTIGATION AND RESPONSE PLATFORM Zsolt Kocsis IBM Security Technical Executive, CEE zsolt.kocsis@hu.ibm.com 6th Nov 2018 Build an integrated
Sharing What Matters. Accelerating Incident Response and Threat Hunting by Sharing Behavioral Data
Sharing What Matters Accelerating Incident Response and Threat Hunting by Sharing Behavioral Data Dan Gunter, Principal Threat Analyst Marc Seitz, Threat Analyst Dragos, Inc. August 2018 Today s Talk at
THE RSA SUITE NETWITNESS REINVENT YOUR SIEM. Presented by: Walter Abeson
THE RSA NETWITNESS SUITE REINVENT YOUR SIEM Presented by: Walter Abeson 1 Reality Goals GOALS VERSUS REALITY OF SIEM 1.0 Single compliance & security interface Analyze & prioritize alerts across various
RSA NetWitness Suite Respond in Minutes, Not Months
RSA NetWitness Suite Respond in Minutes, Not Months Overview One can hardly pick up a newspaper or turn on the news without hearing about the latest security breaches. The Verizon 2015 Data Breach Investigations
R-SCOPING THE HUNT. An integrated solution with
Securely Target. Hunt. explore Disrupt. your data R-SCOPING THE HUNT An integrated solution with THE DETECTION AND RESPONSE GAP What? 205 days on average to detect a breach Advanced adversaries Perimeter
SOC AUTOMATION OF THREAT INVESTIGATION
SOC AUTOMATION OF THREAT INVESTIGATION White Paper When a Security Operations Center (SOC) is shown on TV, it has a specific portrayal. There is a large wall full of screens. World maps showing the threat
CYBER THREAT HUNTING DETECT ADVANCED THREATS HIDING IN YOUR NETWORK. A guide to the most effective methods.
CYBER THREAT HUNTING DETECT ADVANCED THREATS HIDING IN YOUR NETWORK A guide to the most effective methods. CONTENTS BREAKDOWN 2 THE NEED. 3 WHEN TO CHOOSE THREAT HUNTING 4 THE LIFARS SOLUTION 6 ENDPOINT
QuickSpecs. Aruba IntroSpect User and Entity Behavior Analytics. Overview. Aruba IntroSpect User and Entity Behavior Analytics Product overview
Overview Product overview Aruba s User and Entity Behavior Analytics (UEBA) solution, Aruba IntroSpect, detects attacks by spotting small changes in behavior that are often indicative of attacks that have
The Mechanics of Cyber Threat Information Sharing
The Mechanics of Cyber Threat Information Sharing Session 229, February 23, 2017 Denise Anderson, President, National Health Information Sharing and Analysis Center (NH-ISAC) Julie Connolly, Principal
ATT&CKing for better Defense: An Introduction to the MITRE ATT&CK Framework
ATT&CKing for better Defense: An Introduction to the MITRE ATT&CK Framework Random Image Taken From: http://www.flickr.com/photos/sophos_germany/3321556353/ Agenda Introductions The Problem MITRE ATT&CK
Introduction to Threat Deception for Modern Cyber Warfare
Introduction to Threat Deception for Modern Cyber Warfare Joseph R. Salazar Technical Deception Engineer CISSP, CEH, EnCE 1 Introduction AGENDA Attacker Playbook The Need for Deception Deception as Detection
WHITE PAPER. Operationalizing Threat Intelligence Data: The Problems of Relevance and Scale
WHITE PAPER Operationalizing Threat Intelligence Data: The Problems of Relevance and Scale Operationalizing Threat Intelligence Data: The Problems of Relevance and Scale One key number that is generally
First Look Showcase. Expanding our prevention, detection and response solutions. Sumedh Thakar Chief Product Officer, Qualys, Inc.
18 QUALYS SECURITY CONFERENCE 2018 First Look Showcase Expanding our prevention, detection and response solutions Sumedh Thakar Chief Product Officer, Qualys, Inc. Secure Enterprise Mobility Identity (X.509,
A Process is No One: Hunting for Token Manipulation. Jared Atkinson & Robby Winchester
Jared Atkinson Robert Winchester A Process is No One: Hunting for Token Manipulation Jared Atkinson & Robby Winchester @jaredcatkinson Adversary Detection Technical Lead @ SpecterOps Developer: PowerForensics
Course Outline Topic 1: Current State Assessment, Security Operations Centers, and Security Architecture
About this Course This course will best position your organization to analyse threats and detect anomalies that could indicate cybercriminal behaviour. The payoff for this new proactive approach would
ATT&CKing The Command Line & Hunting For More
ATT&CKing The Command Line & Hunting For More Evan Gaustad Principal Threat Detection Engineer LogicHub Agenda Threat Hunting Automation Motivation MITRE ATT&CK & LOLBAS Process Execution Logs Artificial
A Game between Adversary and AI Scientist
A Game between Adversary and AI Scientist NULLCON March 3, 2018 Satnam, Arunabha, Deepak, Waseem, Nirmesh, Santosh, Balamurali, Narayana Acalvio Technologies Who am I At Acalvio from Day 1 15+ Years in
Building a Threat-Based Cyber Team
Building a Threat-Based Cyber Team Anthony Talamantes Manager, Defensive Cyber Operations Todd Kight Lead Cyber Threat Analyst Sep 26, 2017 Washington, DC Forward-Looking Statements During the course of
CONTROLLING YOUR OWN BATTLESPACE. From Threat Response Teams To Threat Intelligence Teams
CONTROLLING YOUR OWN BATTLESPACE From Threat Response Teams To Threat Intelligence Teams Agenda Motivations The Intelligence Process The Cyber Kill Chain Approach Indicators of Compromise Information Sharing
Incident Scale
SESSION ID: SOP-T07 Incident Response @ Scale Salah Altokhais Incident Response Consultant National Cyber Security Center (NCSC),KSA @salah.altokhais Khalid Alsuwaiyel Incident Response Specialist National
Next-generation Endpoint Security and Cybereason
Enterprise Strategy Group Getting to the bigger truth. Solution Showcase Next-generation Endpoint Security and Cybereason Date: March 2018 Author: Jon Oltsik, Senior Principal Analyst Abstract: Since the
Cisco Cyber Range. Paul Qiu Senior Solutions Architect
Cisco Cyber Range Paul Qiu Senior Solutions Architect Cyber Range Service A platform to experience the intelligent Cyber Security for the real world What I hear, I forget What I see, I remember What I
Cloud and Cyber Security Expo 2019
Cloud and Cyber Security Expo 2019 The Terrain to Actionable Intelligence Azeem Aleem, VP Consulting, NTT Security Actionable Intelligence Actionable intelligence through Cyber Intelligence Embedding intelligence
First Look Showcase. Expanding our prevention, detection and response solutions. Marco Rottigni Chief Technical Security Officer, Qualys, Inc.
18 QUALYS SECURITY CONFERENCE 2018 First Look Showcase Expanding our prevention, detection and response solutions Marco Rottigni Chief Technical Security Officer, Qualys, Inc. Secure Enterprise Mobility
Qualys Indication of Compromise
18 QUALYS SECURITY CONFERENCE 2018 Qualys Indication of Compromise Bringing IOC to the Next Level Chris Carlson VP, Product Management, Qualys, Inc. Adversary TTPs are Changing Early 2010s Zero-day Vulnerabilities
Not your Father s SIEM
Not your Father s SIEM Getting Better Insights & Results Bill Thorn Director, Security Operations Apollo Education Group Agenda Why use a SIEM? What is a SIEM? Benefits of Using a SIEM Considerations Before
Threat Hunting and Killing in the Modern Network
Welcome MTUG Security Track Workshop Threat Hunting and Killing in the Modern Network Peter Higgins, CISSP-ISSAP Security Officer Tyler Technologies, Inc. peter.higgins@tylertech.com 800-772-2260x4647
WHITEPAPER. Hunt Like a Pro: A Threat Hunting Guide for Cb Response
WHITEPAPER Hunt Like a Pro: A Threat Hunting Guide for Cb Response OVERVIEW 91% of organizations reported improvements in speed and accuracy of response as a direct result of their threat hunting practices
MEETING ISO STANDARDS
WHITE PAPER MEETING ISO 27002 STANDARDS September 2018 SECURITY GUIDELINE COMPLIANCE Organizations have seen a rapid increase in malicious insider threats, sensitive data exfiltration, and other advanced
Introducing Cyber Observer
"Organizations are failing at early breach detection, with more than 92% of breaches undetected by the breached organization. The situation can be improved with stronger threat intelligence, the addition
Best Practices for Scoping Infections and Disrupting Breaches
2017 SPLUNK INC. Best Practices for Scoping Infections and Disrupting Breaches Analytics-Driven Security Alain Gutknecht Staff SE alain@splunk.com 2017 SPLUNK INC. The Ever-Changing Threat Landscape 100%
FTA 2017 SEATTLE. Cybersecurity and the State Tax Threat Environment. Copyright FireEye, Inc. All rights reserved.
FTA 2017 SEATTLE Cybersecurity and the State Tax Threat Environment 1 Agenda Cybersecurity Trends By the Numbers Attack Trends Defensive Trends State and Local Intelligence What Can You Do? 2 2016: Who
Readiness, Response & Resilence:
Readiness, Response & Resilence: building out advance security operations Husam Al Saraf Solutions Principal Lead Turkey, Africa & Middle East #RSAemeaSummit 1 Traditional Security Operations Top Gaps
Eliminating the Blind Spot: Rapidly Detect and Respond to the Advanced and Evasive Threat
WHITE PAPER Eliminating the Blind Spot: Rapidly Detect and Respond to the Advanced and Evasive Threat Executive Summary Unfortunately, it s a foregone conclusion that no organisation is 100 percent safe
Live Adversary Simulation: Red and Blue Team Tactics
SESSION ID: HTA-T06 Live Adversary Simulation: Red and Blue Team Tactics James Lyne Head of R&D SANS Institute @JamesLyne Stephen Sims Security Researcher & Fellow SANS Institute @Steph3nSims Agenda 2
Home-Grown Cyber Security
Home-Grown Cyber Security John B. Folkerts, CISSP https://www.linkedin.com/in/john-b-folkerts About Me 20 years doing Information Security, Architecture, and Risk Management in large enterprise environments
esendpoint Next-gen endpoint threat detection and response
DATA SHEET esendpoint Next-gen endpoint threat detection and response esendpoint powered by Carbon Black eliminates endpoint blind-spots that traditional technologies miss. Operating on a philosophy that
CyberArk Privileged Threat Analytics
CyberArk Privileged Threat Analytics Table of Contents The New Security Battleground: Inside Your Network 3 Privileged account security 3 Collect the right data 4 Detect critical threats 5 Alert on critical
Understanding Targeted Attacks. Sean Mason VP, Incident Response
Understanding Targeted Attacks Sean Mason VP, Incident Response Sean A. Mason www.seanmason.com @SeanAMason Security Analyst IR Mgr Director IR Executive IR Leader VP, Incident Response Sr. IT Auditor
Sandboxing and the SOC
Sandboxing and the SOC Place McAfee Advanced Threat Defense at the center of your investigation workflow As you strive to further enable your security operations center (SOC), you want your analysts and
The Future of Threat Prevention
The Future of Threat Prevention Bricata is the leading developer of Next Generation Intrusion Prevention Systems (NGIPS) technology, providing innovative, disruptive, high-speed, high-performance network
End-to-End Security Analytics with the Elastic Stack. Samir Bennacer
End-to-End Security Analytics with the Elastic Stack Samir Bennacer!1 !2 Attacks are inevitable Cybersecurity Maturity Curve Phase 1 Security Event Management Phase 2 Automation Phase 3 Proactive Analytics
BREACHES HAPPEN: BE PREPARED. Endpoint Detection & Response
BREACHES HAPPEN: BE PREPARED. Endpoint Detection & Response INTRO PROTECT YOUR BUSINESS AND ITS DATA AGAINST ADVANCED ATTACKS Effective pre-compromise threat prevention is the cornerstone of cyber security,
Upgrade your SOC with Security Analytics and Orchestration
CyberActive SM Upgrade your SOC with Security Analytics and Orchestration Author: Rajat Mohanty, CEO, Paladion Networks 1 Overview Security teams are always on the lookout to enhance the capabilities of
RSA Security Analytics
RSA Security Analytics This is what SIEM was Meant to Be 1 The Original Intent of SIEM Single compliance & security interface Analyze & prioritize alerts across various sources The cornerstone of security
McAfee Advanced Threat Defense
Advanced Threat Defense Detect advanced malware Advanced Threat Defense enables organizations to detect advanced, evasive malware and convert threat information into immediate action and protection. Unlike
SOLUTION BRIEF ASSESSING DECEPTION TECHNOLOGY FOR A PROACTIVE DEFENSE
SOLUTION BRIEF ASSESSING DECEPTION TECHNOLOGY FOR A PROACTIVE DEFENSE 1 EXECUTIVE SUMMARY Attackers have repeatedly demonstrated they can bypass an organization s conventional defenses. To remain effective,
Colin Gibbens Director, Product Management
SOAR = Human Intelligence and Creativity at Speed of Machine Abhishek Narula EVP, Head of Product and Engineering Colin Gibbens Director, Product Management 1 2 What is Security Orchestration Why do I
Building and Instrumenting the Next- Generation Security Operations Center. Sponsored by
Building and Instrumenting the Next- Generation Security Operations Center Sponsored by Webinar Logistics Optimize your experience today Enable pop-ups within your browser Turn on your system s sound to
Sobering statistics. The frequency and sophistication of cybersecurity attacks are getting worse.
Sobering statistics The frequency and sophistication of cybersecurity attacks are getting worse. 146 >63% $500B $3.8M The median # of days that attackers reside within a victim s network before detection
ADVANCED THREAT HUNTING
ERADICATE CONCEALED THREATS: ADVANCED THREAT HUNTING WITH CARBON BLACK OVERVIEW OVERVIEW In a SANS survey, 56% of incident responders claim they assume their enterprise is already compromised i. By preparing
Enhancing Threat Intelligence Data. 05/24/2017 DC416
Enhancing Threat Intelligence Data By @3ncr1pted 05/24/2017 DC416 Security consultant researcher/analyst in Threat Intel. Loves APTs, mainframes, ICS SCADA & creating security awareness StarTrek! Boldly
Reducing the Cost of Incident Response
Reducing the Cost of Incident Response Introduction Cb Response is the most complete endpoint detection and response solution available to security teams who want a single platform for hunting threats,
Microsoft Advance Threat Analytics (ATA) at LLNL NLIT Summit 2018
Microsoft Advance Threat Analytics (ATA) at LLNL NLIT Summit 2018 May, 22, 2018 John Wong wong76@llnl.gov Systems & Network Associate This work was performed under the auspices of the U.S. Department of
Business Context: Key for Successful Risk Management
Business Context: Key for Successful Risk Management Philip Aldrich, CISSP, CISM, CISA, CRISC, CIPP Program Director, Risk Management EMC Event Alert Finding Incident Law Vulnerability Regulation Audit
THREAT INTEL AND CONTENT CURATION: ORGANIZING THE PATH TO SUCCESSFUL DETECTION
SESSION ID: AIR-W12 THREAT INTEL AND CONTENT CURATION: ORGANIZING THE PATH TO SUCCESSFUL DETECTION Justin Monti CTO MKACyber Mischel Kwon CEO MKACyber @MKACyber What is Cyber Threat Intelligence Data collected,
RSA ECAT DETECT, ANALYZE, RESPOND!
RSA ECAT DETECT, ANALYZE, RESPOND! Cyber Threat Landscape Attack surface (& attackers) expanding Web app Existing strategies & controls are failing Laptop EHR Firewall Attacks sophistication on the rise
Digital Forensics Readiness PREPARE BEFORE AN INCIDENT HAPPENS
Digital Forensics Readiness PREPARE BEFORE AN INCIDENT HAPPENS Digital Forensics Readiness: PREPARE BEFORE AN INCIDENT HAPPENS 2 Digital Forensics Readiness The idea that all networks can be compromised
Compare Security Analytics Solutions
Compare Security Analytics Solutions Learn how Cisco Stealthwatch compares with other security analytics products. This solution scales easily, giving you visibility across the entire network. Stealthwatch
CYBER RISK MANAGEMENT: ADDRESSING THE CHALLENGE SIMON CRUMPLIN, FOUNDER & CEO
CYBER RISK MANAGEMENT: ADDRESSING THE CHALLENGE SIMON CRUMPLIN, FOUNDER & CEO INFORMATION SECURITY PAINS CISO RESPONSIBILITY WITHOUT AUTHORITY INVENTORY TO MANAGE ALERTS WITHOUT MEANING ASSETS SPREAD ACROSS
Building Resilience in a Digital Enterprise
Building Resilience in a Digital Enterprise Top five steps to help reduce the risk of advanced targeted attacks To be successful in business today, an enterprise must operate securely in the cyberdomain.
Automated Threat Management - in Real Time. Vectra Networks
Automated Threat Management - in Real Time Security investment has traditionally been in two areas Prevention Phase Active Phase Clean-up Phase Initial Infection Key assets found in the wild $$$$ $$$ $$
INCIDENTRESPONSE.COM. Automate Response. Did you know? Your playbook overview - Unauthorized Access
Automate Response Congratulations on selecting IncidentResponse.com to retrieve your custom incident response playbook guide. This guide has been created especially for you for use in within your security
TTPs for Threat Hunting in Refineries. Dan Gunter Principal Threat Dragos October 2018
TTPs for Threat Hunting in Refineries Dan Gunter Twitter: @dan_gunter Principal Threat Analyst @ Dragos October 2018 Talk Overview Start theoretical, end applied What to do? How to do it? Useful Open Source
Key Technologies for Security Operations. Copyright 2014 EMC Corporation. All rights reserved.
Key Technologies for Security Operations 2 Traditional Security Is Not Working 97% of breaches led to compromise within days or less with 72% leading to data exfiltration in the same time Source: Verizon
align security instill confidence
align security instill confidence cyber security Securing data has become a top priority across all industries. High-profile data breaches and the proliferation of advanced persistent threats have changed
Automated Response in Cyber Security SOC with Actionable Threat Intelligence
Automated Response in Cyber Security SOC with Actionable Threat Intelligence while its biggest weakness is lack of visibility: SOCs still can t detect previously unknown threats, which is a consistent
Getting Security Operations Right with TTP0
0 Getting Security Operations Right with TTP0 Ismael Valenzuela SANS Instructor, McAfee @aboutsecurity Rob Gresham Splunk> Phantom @SOCologize Where were you in 1986? 0 What is the story? Google Market
Whitepaper. Advanced Threat Hunting with Carbon Black Enterprise Response
Advanced Threat Hunting with Carbon Black Enterprise Response TABLE OF CONTENTS Overview Threat Hunting Defined Existing Challenges and Solutions Prioritize Endpoint Data Collection Over Detection Leverage
Threat Intel for All: There s More to Your Data than Meets the Eye
Threat Intel for All: There s More to Your Data than Meets the Eye By @3ncr1pted 07/28/2017 Wall of Sheep Security consultant researcher/analyst in Threat Intel. Loves APTs, mainframes, ICS SCADA & creating
THE EVOLUTION OF SIEM
THE EVOLUTION OF SIEM Why it is critical to move beyond logs BUSINESS-DRIVEN SECURITY SOLUTIONS THE EVOLUTION OF SIEM Why it is critical to move beyond logs Despite increasing investments in security,
Testing for cyber resilience tools & techniques for adversary simulation and improved defense
Testing for cyber resilience tools & techniques for adversary simulation and improved defense Adrian Ifrim & Teodor Cimpoesu, Deloitte Cyber Resilience in Focus NIS Directive to bring cybersecurity capabilities
INCIDENTRESPONSE.COM. Automate Response. Did you know? Your playbook overview - Data Theft
Automate Response Congratulations on selecting IncidentResponse.com to retrieve your custom incident response playbook guide. This guide has been created especially for you for use in within your security
Security analytics: From data to action Visual and analytical approaches to detecting modern adversaries
Security analytics: From data to action Visual and analytical approaches to detecting modern adversaries Chris Calvert, CISSP, CISM Director of Solutions Innovation Copyright 2013 Hewlett-Packard Development
SOLUTION BRIEF RSA NETWITNESS EVOLVED SIEM
RSA NETWITNESS EVOLVED SIEM OVERVIEW A SIEM is technology originally intended for compliance and log management. Later, as SIEMs became the aggregation points for security alerts, they began to be more
Cyber Defense Maturity Scorecard DEFINING CYBERSECURITY MATURITY ACROSS KEY DOMAINS
Cyber Defense Maturity Scorecard DEFINING CYBERSECURITY MATURITY ACROSS KEY DOMAINS Cyber Defense Maturity Scorecard DEFINING CYBERSECURITY MATURITY ACROSS KEY DOMAINS Continual disclosed and reported
NOTHING IS WHAT IT SIEMs: COVER PAGE. Simpler Way to Effective Threat Management TEMPLATE. Dan Pitman Principal Security Architect
NOTHING IS WHAT IT SIEMs: COVER PAGE Simpler Way to Effective Threat Management TEMPLATE Dan Pitman Principal Security Architect Cybersecurity is harder than it should be 2 SIEM can be harder than it should
STAY ONE STEP AHEAD OF THE CRIMINAL MIND. F-Secure Rapid Detection & Response
STAY ONE STEP AHEAD OF THE CRIMINAL MIND F-Secure Rapid Detection & Response INTRO PROTECT YOUR BUSINESS AND ITS DATA AGAINST ADVANCED ATTACKS Effective pre-compromise threat prevention is the cornerstone
ISO COMPLIANCE GUIDE. How Rapid7 Can Help You Achieve Compliance with ISO 27002
ISO 27002 COMPLIANCE GUIDE How Rapid7 Can Help You Achieve Compliance with ISO 27002 A CONTENTS Introduction 2 Detailed Controls Mapping 3 About Rapid7 8 rapid7.com ISO 27002 Compliance Guide 1 INTRODUCTION
ATTIVO NETWORKS THREATDEFEND INTEGRATION WITH MCAFEE SOLUTIONS
PARTNER BRIEF ATTIVO NETWORKS THREATDEFEND INTEGRATION WITH MCAFEE SOLUTIONS INTRODUCTION Attivo Networks has partnered with McAfee to detect real-time in-network threats and to automate incident response
War Stories on Powering Incident Response with Intelligence
War Stories on Powering Incident Response with Intelligence Indicators What are They Good For? It depends Atomic Indicators must be high confidence to be useful 2 Herd Immunity Patient zero dies so others
Converged security. Gerben Verstraete, CTO, HP Software Services Colin Henderson, Managing Principal, Enterprise Security Products
Converged security Gerben Verstraete, CTO, HP Software Services Colin Henderson, Managing Principal, Enterprise Security Products Increased risk and wasted resources Gartner estimates more than $1B in
RSA Advanced Security Operations Richard Nichols, Director EMEA. Copyright 2015 EMC Corporation. All rights reserved. 1
RSA Advanced Security Operations Richard Nichols, Director EMEA 1 What is the problem we need to solve? 2 Attackers Are Outpacing Defenders..and the Gap is Widening Attacker Capabilities The defender-detection
2015 NTX-ISSA Cyber Security Conference (Spring) Advanced Persistent Threat (APT) Life Cycle Management
2015 NTX-ISSA Cyber Security Conference (Spring) Advanced Persistent Threat (APT) Life Cycle Management April 24-25, 2015 Copyright 2015 NTX-ISSA 2015 Raytheon Cyber Security Company. Conference All rights
Enhancing the Cybersecurity of Federal Information and Assets through CSIP
TECH BRIEF How BeyondTrust Helps Government Agencies Address Privileged Access Management to Improve Security Contents Introduction... 2 Achieving CSIP Objectives... 2 Steps to improve protection... 3
THREAT HUNTING 2017 REPORT PRESENTED BY
THREAT HUNTING 2017 REPORT PRESENTED BY THREAT HUNTING 2017 REPORT TABLE OF CONTENTS Overview Key Survey Findings Familiarity with Threat Hunting Threat Hunting Priority Top Challenges for SOCs Confidence
The Rise of the Purple Team
SESSION ID: AIR-W02 The Rise of the Purple Team Robert Wood Head of Security Nuna @robertwood50 William Bengtson Senior Security Program Manager Nuna @waggie2009 Typical Team Responsibilities Red Vulnerability
The Critical Assets Filter for the SOC Focus discovery and analytics to expedite security investigations
White Paper Focus discovery and analytics to expedite security investigations By Barbara Kay, CISSP With limited analyst time and many alerts going untriaged, security operation centers are getting more
INCIDENT HANDLING & RESPONSE PROFESSIONAL VERSION 1
INCIDENT HANDLING & RESPONSE PROFESSIONAL VERSION 1 The most practical and comprehensive training course on incident handling & response elearnsecurity has been chosen by students in over 140 countries