Avoiding Information Overload: Automated Data Processing with n6
|
|
|
- Stewart Anthony
- 6 years ago
- Views:
Transcription
1 Avoiding Information Overload: Automated Data Processing with n6 Paweł Pawliński 26th annual FIRST conference Boston, June 23rd 2014
2 Who we are part of national CERT for Poland Paweł Pawliński Avoiding Information Overload 1 / 42
3 Goals Mission statement: (...) assist Polish internet users in implementing proactive measures to reduce the risks of computer security incidents and to assist them in responding to such incidents when they occur. (...) Some common objectives: reduce number of infections detect attacks quicker make systems more difficult to attack Use information! attacks victims vectors... Paweł Pawliński Avoiding Information Overload 2 / 42
4 Buzzwords? information Paweł Pawliński Avoiding Information Overload 3 / 42
5 Buzzwords? security information Paweł Pawliński Avoiding Information Overload 3 / 42
6 Buzzwords? security information intelligence Paweł Pawliński Avoiding Information Overload 3 / 42
7 Buzzwords? security cyber threat information intelligence Paweł Pawliński Avoiding Information Overload 3 / 42
8 Buzzwords? security cyber threat information feed global intelligence Paweł Pawliński Avoiding Information Overload 3 / 42
9 Buzzwords? internet security data platform cyber threat information feed global actionable intelligence solution real-time Paweł Pawliński Avoiding Information Overload 3 / 42
10 Buzzwords? internet security data platform cyber threat information feed global actionable intelligence solution real-time big data analytics TM Paweł Pawliński Avoiding Information Overload 3 / 42
11 Buzzwords? internet security data platform cyber threat information feed global actionable intelligence solution real-time big data analytics TM Paweł Pawliński Avoiding Information Overload 3 / 42
12 Related efforts ENISA report Good practice guide for the exchange and processing of actionable information by CERTs expected publication: end of 2014 Nippon-European Cyberdefense-Oriented Multilayer threat Analysis ongoing research Consortium: Institut Mines-Telecom, Atos, FORTH, NASK, 6cure, Nara Institute of Science and Technology, Internet Initiative Japan, National Institute of Informatics, Keio University, University of Tokyo Paweł Pawliński Avoiding Information Overload 4 / 42
13 What is actionable? action depends on the recipient Kill Chain indicators for every stage known attack properties detect / block signal when investigation is needed Paweł Pawliński Avoiding Information Overload 5 / 42
14 Year 2011 in automation commercial entities own systems non-profits Paweł Pawliński Avoiding Information Overload 6 / 42
15 Year 2011 in automation Daily collecting 10MiB+, 100k+ records C&C, bots, scanners, spammers < 10 sources Multiple shell scripts Automated sharing with 30 external organizations Unmanageable Analyses in a shell-style: awk... perl -ne... > report.txt Paweł Pawliński Avoiding Information Overload 7 / 42
16 n6: first generation Main goals: 1 get better value from data 2 share with more entities 3 add more sources Introducing Network Security Incident exchange Technical objectives: single channel for all automatic data exchange keep the original input data for reference enrich with information from BGP & DNS asynchronous processing high throughput: gigabytes, 10M+ events daily access through HTTPS, authorized by client SSL certificates Paweł Pawliński Avoiding Information Overload 8 / 42
17 Automated sources of information commercial entities own systems non-profits public sources Paweł Pawliński Avoiding Information Overload 9 / 42
18 Data collected by us Early-warning system: ARAKIS Botnet monitoring Sandbox Sinkhole multiple botnets up to 700 connections & 10k packets per second Tomasz Bukowski The Art of Sinkholing June 24th (Tuesday) Sparks Paweł Pawliński Avoiding Information Overload 10 / 42
19 Data from external sources Types: Malicious websites C&C servers Infected machines Phishing Open proxies Open resolvers Bot configuration Scanning hosts Spammers 25 organizations 45 feeds Paweł Pawliński Avoiding Information Overload 11 / 42
20 Recipients registered automated 0 07/ / / / /2014 Paweł Pawliński Avoiding Information Overload 12 / 42
21 Records processed daily bots misconfigured scanning malurl phishing other cnc / / / /2014 spam Paweł Pawliński Avoiding Information Overload 13 / 42
22 Meanwhile... Other systems for processing similar information: Megatron (CERT-SE) AbuseHelper (CERT-FI) Collective Intelligence Framework (REN-ISAC) add your project here:... Paweł Pawliński Avoiding Information Overload 14 / 42
23 Generalized data-processing system raw indicator high-level collect 1 prepare store analyze distribute raw indicator high-level non-operational non-operational Paweł Pawliński Avoiding Information Overload 15 / 42
24 Types of information Raw data Examples: traffic dumps, NetFlow logs output from honeypots usually machine generated requires further analysis integration with other systems Indicators Examples: IPs, domains, URLs, malware hashes type-specific metadata (e.g. header) labeled data (known security context) usually machine generated can be deployed in automated security systems Paweł Pawliński Avoiding Information Overload 16 / 42
25 Types of information (continued) High-level data Examples: vulnerability alert TTP, actors affected assets other alerts (e.g. anomaly) often human input not always possible to automate handling Non-operational supports decision making Paweł Pawliński Avoiding Information Overload 17 / 42
26 Non-operational information map.honeynet.org Paweł Pawliński Avoiding Information Overload 18 / 42
27 Generalized data-processing system raw indicator high-level collect 1 prepare store analyze distribute raw indicator high-level non-operational non-operational Paweł Pawliński Avoiding Information Overload 19 / 42
28 Collect Location: internal vs external Producer: machine generated vs human input One-time vs regular Batch vs stream Push vs pull Paweł Pawliński Avoiding Information Overload 20 / 42
29 Prepare Parsing multiple formats changes to existing feeds Normalization lack of common ontology bot names Aggregation Enrichment GeoIP known entities (ContactDB project by CERT.at & others) correlation Uncertainty degree of trust in the source accuracy of classification Paweł Pawliński Avoiding Information Overload 21 / 42
30 Store Volume: megabytes petabytes Dataset management Data model Technology SQL databases HBase flat files... Paweł Pawliński Avoiding Information Overload 22 / 42
31 Analyze Investigation (queries) Trends Anomalies Common patterns Identify campaigns...? Paweł Pawliński Avoiding Information Overload 23 / 42
32 Distribute Identify recipients Technical aspects API format standards push vs pull How to utilize available information? Paweł Pawliński Avoiding Information Overload 24 / 42
33 n6: The Next Generation n6 in mid-2013: millions records per day sharing with many entities existing scripts for integration with other systems growing wishlist Redesign more scalable make data more accessible easier to add new features from Perl + Python + Bash to pure Python Tests ongoing Gradual transition to the new version Paweł Pawliński Avoiding Information Overload 25 / 42
34 n6: data collection Indicator-level information Multiple external feeds of varying quality Multiple internal feeds Medium high volume Mostly coming in batches but also streams Paweł Pawliński Avoiding Information Overload 26 / 42
35 n6: data preparation Event-oriented processing Normalization of incoming data Enrichment: DNS, ASN Aggregation Organization mapping Paweł Pawliński Avoiding Information Overload 27 / 42
36 n6: storage Keeping original data Central DB for normalized events SQL (MySQL / TokuDB) Critical for overall performance Paweł Pawliński Avoiding Information Overload 28 / 42
37 n6: analysis Annual report for 2013: Ad-hoc queries Planned: continuous automated analyzes Paweł Pawliński Avoiding Information Overload 29 / 42
38 n6: distribution of data Multiple output formats: JSON, CSV, IODEF Fine-grained permission model API REST stream Paweł Pawliński Avoiding Information Overload 30 / 42
39 Previously DOMAIN IPs ASNs alotibi.panadool400.com anowona.cn , , , ,18779,18779,18779 arta.romail3arnest.info asp.spinchats.com bambambam.info bff.7oorq8.com bff4.7oorq8.com bunker.org.ua computo164.laweb.es ff.converter50.com hcuewgbbnfdu1ew.com hcuewgbbnfs1uew.com internet.estr.es kubusse.ru legionarios.servecounterstrike.com "time (UTC)","ip","asn","cc","target","fqdn","url" " :09:19"," ","8342","RU","Other","fexinfos.1gb.ru"," " :08:56"," ","8342","RU","Other","fexinfos.1gb.ru"," " :34:22"," ","36351","US","Other"," static.reverse.sof " :33:12"," , ","30060,30060","US,US","Other","bit.ly"," " :35:21"," ","36351","US","Other"," static.reverse.sof " :19:50"," ","35818","RO","Apple","apple.com-infomartion-account-update- " :58:08"," ","10929","CA","Other"," Paweł Pawliński Avoiding Information Overload 31 / 42
40 Now: unified format [ ] { }, { } "address": [ { "ip": " ", "cc": "PL", "asn": } ], "adip": "x ", "category": "bots", "confidence": "medium", "count": 18, "dport": 80, "fqdn": "example.com", "id": "26c8fd dd15dc8431b267c65cf", "name": "B58-DGA2", "origin": "sinkhole", "proto": tcp, "source": "b", "sport": 51869, "time": " T15:35:32", "until": " T19:00:00"... Paweł Pawliński Avoiding Information Overload 32 / 42
41 n6: web interface Paweł Pawliński Avoiding Information Overload 33 / 42
42 n6: web interface Paweł Pawliński Avoiding Information Overload 34 / 42
43 ARAKIS Early warning system Developed by NASK Operational since 2007 Paweł Pawliński Avoiding Information Overload 35 / 42
44 ARAKIS: data collection Large number of sensors in Polish address space Multiple participating organizations Server-side honeypots Firewall logs Darknet raw data Paweł Pawliński Avoiding Information Overload 36 / 42
45 ARAKIS: data preparation GeoIP Matching against known networks Paweł Pawliński Avoiding Information Overload 37 / 42
46 ARAKIS: storage MySQL Raw data (PCAP & logs) available Periodic cleanup Paweł Pawliński Avoiding Information Overload 38 / 42
47 ARAKIS: analysis Trend analysis for port protocol pairs Identifying common patterns text-mining algorithms applied to network traffic using clusterization algorithm to group similar attacks Rankings Rare event detection Paweł Pawliński Avoiding Information Overload 39 / 42
48 ARAKIS: distribution Integration with n6 Reports for selected areas by Many features are human-oriented Public interface: Paweł Pawliński Avoiding Information Overload 40 / 42
49 Challenges Assessing quality of information Creating vs forwarding actionable information Situational awareness observe ongoing campaigns identify compromised parts of the infrastructure assess risks... Requirements: knowledge of assets & threats scale matters not only actionable information Paweł Pawliński Avoiding Information Overload 41 / 42
50 BoF session Finding & Sharing Actionable Information US-CERT & CERT Polska June 25th (Wednesday) 16:30 18:00 Paweł Pawliński Avoiding Information Overload 42 / 42
51 Thank you for your attention. Questions / Comments?
52 This work has been supported by the Strategic International Collaborative R&D Promotion Project of the Ministry of Internal Affairs and Communication, Japan, and by the European Union Seventh Framework Programme (FP7/ ) under grant agreement No (NECOMA). The opinions expressed in this presentation are those of the author and do not necessarily reflect the views of the Ministry of Internal Affairs and Communications, Japan, or of the European Commission.
Nippon-European Cyberdefense-Oriented Multilayer Threat Analysis (NECOMA Project)
Nippon-European Cyberdefense-Oriented Multilayer Threat Analysis (NECOMA Project) Director : Youki Kadobayashi Nara Institute of Science and Technology Presentator : Yuji Sekiya The University of Tokyo
CYBER ANALYTICS. Architecture Overview. Technical Brief. May 2016 novetta.com 2016, Novetta
CYBER ANALYTICS Architecture Overview Technical Brief May 2016 novetta.com 2016, Novetta Novetta Cyber Analytics: Technical Architecture Overview 1 INTRODUCTION 2 CAPTURE AND PROCESS ALL NETWORK TRAFFIC
MILE Implementation Report. Chris Inacio, Carnegie Mellon University Daisuke Miyamoto, The University of Tokyo
MILE Implementation Report Chris Inacio, Carnegie Mellon University Daisuke Miyamoto, The University of Tokyo daisu-mi@nc.u-tokyo.ac.jp Updates in Section 2 Information Sharing and Analysis Centers (ISAC)
SEVENTH FRAMEWORK PROGRAMME. Deliverable D1.4: Threat Data Final Report
SEVENTH FRAMEWORK PROGRAMME Information & Communication Technologies ICT Cooperation Programme Nippon-European Cyberdefense-Oriented Multilayer threat Analysis Deliverable D1.4: Threat Data Final Report
Detect Cyber Threats with Securonix Proxy Traffic Analyzer
Detect Cyber Threats with Securonix Proxy Traffic Analyzer Introduction Many organizations encounter an extremely high volume of proxy data on a daily basis. The volume of proxy data can range from 100
Novetta Cyber Analytics
Know your network. Arm your analysts. Introduction Novetta Cyber Analytics is an advanced network traffic analytics solution that empowers analysts with comprehensive, near real time cyber security visibility
Threat Intel for All: There s More to Your Data than Meets the Eye
Threat Intel for All: There s More to Your Data than Meets the Eye By @3ncr1pted 07/28/2017 Wall of Sheep Security consultant researcher/analyst in Threat Intel. Loves APTs, mainframes, ICS SCADA & creating
Automated Response in Cyber Security SOC with Actionable Threat Intelligence
Automated Response in Cyber Security SOC with Actionable Threat Intelligence while its biggest weakness is lack of visibility: SOCs still can t detect previously unknown threats, which is a consistent
Improved C&C Traffic Detection Using Multidimensional Model and Network Timeline Analysis
Improved C&C Traffic Detection Using Multidimensional Model and Elad Menahem Avidan Avraham Modern Threats Are More Sophisticated & Evasive CYBER KILL CHAIN: Infection Phase Post-Infection Recon Weaponization
Enhancing Threat Intelligence Data. 05/24/2017 DC416
Enhancing Threat Intelligence Data By @3ncr1pted 05/24/2017 DC416 Security consultant researcher/analyst in Threat Intel. Loves APTs, mainframes, ICS SCADA & creating security awareness StarTrek! Boldly
Automated Threat Management - in Real Time. Vectra Networks
Automated Threat Management - in Real Time Security investment has traditionally been in two areas Prevention Phase Active Phase Clean-up Phase Initial Infection Key assets found in the wild $$$$ $$$ $$
Data Sources for Cyber Security Research
Data Sources for Cyber Security Research Melissa Turcotte mturcotte@lanl.gov Advanced Research in Cyber Systems, Los Alamos National Laboratory 14 June 2018 Background Advanced Research in Cyber Systems,
Croatian National CERT ACDC project Darko Perhoc, Head of National CERT CISSP, CEH, CCNP Security R&S,CCDP
Croatian National CERT ACDC project Darko Perhoc, Head of National CERT CISSP, CEH, CCNP Security R&S,CCDP Croatian National CERT (HR-CERT) mission: Promoting and preserving information security of public
ARAKIS An Early Warning and Attack Identification System
ARAKIS An Early Warning and Attack Identification System Piotr Kijewski Piotr.Kijewski@cert.pl 16th Annual FIRST Conference June 13-18, Budapest, Hungary Presentation outline Trends in large scale malicious
Security Monitoring Engineer / (NY or NC) Director, Information Security. New York, NY or Winston-Salem, NC. Location:
Position: Reports to: Location: Security Monitoring Engineer / (NY or NC) Director, Information Security New York, NY or Winston-Salem, NC Position Summary: The Clearing House (TCH) Information Security
Threat Detection and Mitigation for IoT Systems using Self Learning Networks (SLN)
Threat Detection and Mitigation for IoT Systems using Self Learning Networks (SLN) JP Vasseur, PhD - Cisco Fellow jpv@cisco.com Maik G. Seewald, CISSP Sr. Technical Lead maseewal@cisco.com June 2016 Cyber
Threat Containment and Operations. Yong Kwang Kek, Director of Presales SE, APJ
Threat Containment and Operations Yong Kwang Kek, Director of Presales SE, APJ 2018-07-19 1 1 2017 Infoblox Inc. All Rights 2013 Infoblox Inc. All Reserved. Rights Reserved. Three Aspects of Security #1
RSA NetWitness Suite Respond in Minutes, Not Months
RSA NetWitness Suite Respond in Minutes, Not Months Overview One can hardly pick up a newspaper or turn on the news without hearing about the latest security breaches. The Verizon 2015 Data Breach Investigations
New Generation SIEM. Solution Development
New Generation SIEM Solution Development Big Picture of Solution Actions Flow NewGen SIEM Agents Events/Artifacts Data Flow vciso Indicator of Compromise Сollector Solution/Service Title Indicator of Compromise
THE RSA SUITE NETWITNESS REINVENT YOUR SIEM. Presented by: Walter Abeson
THE RSA NETWITNESS SUITE REINVENT YOUR SIEM Presented by: Walter Abeson 1 Reality Goals GOALS VERSUS REALITY OF SIEM 1.0 Single compliance & security interface Analyze & prioritize alerts across various
SOLUTION BRIEF RSA NETWITNESS SUITE 3X THE IMPACT WITH YOUR EXISTING SECURITY TEAM
SOLUTION BRIEF RSA NETWITNESS SUITE 3X THE IMPACT WITH YOUR EXISTING SECURITY TEAM OVERVIEW The Verizon 2016 Data Breach Investigations Report highlights that attackers are regularly outpacing the defenders.
Intelligent and Secure Network
Intelligent and Secure Network BIG-IP IP Global Delivery Intelligence v11.2 IP Intelligence Service Brian Boyan - b.boyan@f5.com Tony Ganzer t.ganzer@f5.com 2 Agenda Welcome & Intro Introduce F5 IP Intelligence
IPS with isensor sees, identifies and blocks more malicious traffic than other IPS solutions
IPS Effectiveness IPS with isensor sees, identifies and blocks more malicious traffic than other IPS solutions An Intrusion Prevention System (IPS) is a critical layer of defense that helps you protect
Cyber Threat Intelligence Standards - A high-level overview
Cyber Threat Intelligence Standards - A high-level overview Christian Doerr TU Delft, Cyber Threat Intelligence Lab Delft University of Technology Challenge the future ~ whoami At TU Delft since 2008 in
FINNISH CYBER DEFENSE MODEL GUIDED TOUR
FINNISH CYBER DEFENSE MODEL GUIDED TOUR SPAM Botnets Identity theft Phishing Denial of Service Defacements @codenomicon BACKGROUND Sindri Bjarnason - sindri@codenomicon.com Senior Solution Engineer at
10x Increase Your Team s Effectiveness by Automating the Boring Stuff
SESSION ID: TTA-R02 10x Increase Your Team s Effectiveness by Automating the Boring Stuff Jonathan Trull Chief Cybersecurity Advisor Microsoft @jonathantrull Vidhi Agarwal Senior Program Manager Microsoft
Update on AbuseHelper
Update on AbuseHelper Christian Van Heurck CERT.be Presentation for Belnet Agenda Description of the intended setup Lessons learned Our idea right now Discussions 2 Overview of the 1 st installation: AH
TRUE SECURITY-AS-A-SERVICE
TRUE SECURITY-AS-A-SERVICE To effectively defend against today s cybercriminals, organizations must look at ways to expand their ability to secure and maintain compliance across their evolving IT infrastructure.
Delivering Integrated Cyber Defense for the Cloud Generation Darren Thomson
Delivering Integrated Cyber Defense for the Generation Darren Thomson Vice President & CTO, EMEA Region Symantec In 2009 there were 2,361,414 new piece of malware created. In 2015 that number was 430,555,582
An Aflac Case Study: Moving a Security Program from Defense to Offense
SESSION ID: CXO-W11 An Aflac Case Study: Moving a Security Program from Defense to Offense Tim Callahan SVP & Global CISO Aflac Threat Landscape Selected losses > 30,000 records (updated 10/15/16) Security
Technical Brochure F-SECURE THREAT SHIELD
Technical Brochure F-SECURE THREAT SHIELD F-SECURE THREATSHIELD F-Secure ThreatShield is a gateway-level security solution for protecting email and web traffic, with built-in network sandboxing technology.
Compare Security Analytics Solutions
Compare Security Analytics Solutions Learn how Cisco Stealthwatch compares with other security analytics products. This solution scales easily, giving you visibility across the entire network. Stealthwatch
Prescriptive Security Operations Centers. Leveraging big data capabilities to build next generation SOC
Prescriptive Security Operations Centers Leveraging big data capabilities to build next generation SOC Cyber Security Industry in constant renewal in 2016 and 2017 1 Tbps Mirai IoT Botnet broke the Internet
CTI Capability Maturity Model Marco Lourenco
1 CTI Capability Maturity Model Cyber Threat Intelligence Course NIS Summer School 2018, Crete October 2018 MARCO LOURENCO - ENISA Cyber Security Analyst Lead European Union Agency for Network and Information
Automating Security Response based on Internet Reputation
Add Your Logo here Do not use master Automating Security Response based on Internet Reputation IP and DNS Reputation for the IPS Platform Anthony Supinski Senior Systems Engineer www.h3cnetworks.com www.3com.com
Emerging Threat Intelligence using IDS/IPS. Chris Arman Kiloyan
Emerging Threat Intelligence using IDS/IPS Chris Arman Kiloyan Who Am I? Chris AUA Graduate (CS) Thesis : Cyber Deception Automation and Threat Intelligence Evaluation Using IDS Integration with Next-Gen
An Aflac Case Study: Moving a Security Program from Defense to Offense
SESSION ID: TTA-F02 An Aflac Case Study: Moving a Security Program from Defense to Offense Tim Callahan SVP & Global Chief Security Officer Aflac Threat Landscape Security risks are growing at a faster
Key Technologies for Security Operations. Copyright 2014 EMC Corporation. All rights reserved.
Key Technologies for Security Operations 2 Traditional Security Is Not Working 97% of breaches led to compromise within days or less with 72% leading to data exfiltration in the same time Source: Verizon
THREAT INTEL AND CONTENT CURATION: ORGANIZING THE PATH TO SUCCESSFUL DETECTION
SESSION ID: AIR-W12 THREAT INTEL AND CONTENT CURATION: ORGANIZING THE PATH TO SUCCESSFUL DETECTION Justin Monti CTO MKACyber Mischel Kwon CEO MKACyber @MKACyber What is Cyber Threat Intelligence Data collected,
FP7 NEMESYS Project: Advances on Mobile Network Security
Enhanced Network Security for Seamless Service Provisioning in the Smart Mobile Ecosystem FP7 NEMESYS Project: Advances on Mobile Network Security Elina Theodoropoulou R&D Projects Section Manager etheodorop@cosmote.gr
CIS Controls Measures and Metrics for Version 7
Level One Level Two Level Three Level Four Level Five Level Six 1.1 Utilize an Active Discovery Tool Utilize an active discovery tool to identify devices connected to the organization's network and update
WHITE PAPER. Operationalizing Threat Intelligence Data: The Problems of Relevance and Scale
WHITE PAPER Operationalizing Threat Intelligence Data: The Problems of Relevance and Scale Operationalizing Threat Intelligence Data: The Problems of Relevance and Scale One key number that is generally
National Cyber Security Operations Center (N-CSOC) Stakeholders' Conference
National Cyber Security Operations Center (N-CSOC) Stakeholders' Conference Benefits to the Stakeholders A Collaborative and Win-Win Strategy Lal Dias Chief Executive Officer Sri Lanka CERT CC Cyber attacks
CIS Controls Measures and Metrics for Version 7
Level 1.1 Utilize an Active Discovery Tool 1.2 Use a Passive Asset Discovery Tool 1.3 Use DHCP Logging to Update Asset Inventory 1.4 Maintain Detailed Asset Inventory 1.5 Maintain Asset Inventory Information
Presentation to the ITU on the Q-CERT Incident Management Team. Ian M Dowdeswell Incident Manager, Q-CERT
Presentation to the ITU on the Q-CERT Incident Management Team Ian M Dowdeswell Incident Manager, Q-CERT 2 Q-CERT Mission The Mission of Q-CERT is to be a world-class center of excellence providing expert
AMP-Based Flow Collection. Greg Virgin - RedJack
AMP-Based Flow Collection Greg Virgin - RedJack AMP- Based Flow Collection AMP - Analytic Metadata Producer : Patented US Government flow / metadata producer AMP generates data including Flows Host metadata
CounterACT Check Point Threat Prevention Module
CounterACT Check Point Threat Prevention Module Version 1.0.0 Table of Contents About the Check Point Threat Prevention Integration... 4 Use Cases... 4 Additional Check Point Threat Prevention Documentation...
With turing you can: Identify, locate and mitigate the effects of botnets or other malware abusing your infrastructure
Decoding DNS data If you have a large DNS infrastructure, understanding what is happening with your real-time and historic traffic is difficult, if not impossible. Until now, the available network management
Ransomware A case study of the impact, recovery and remediation events
Ransomware A case study of the impact, recovery and remediation events Peter Thermos President & CTO Tel: (732) 688-0413 peter.thermos@palindrometech.com Palindrome Technologies 100 Village Court Suite
PRODUCT OVERVIEW. Extend your security intelligence from local network to global cyberspace
PRODUCT OVERVIEW Extend your security intelligence from local network to global cyberspace What is a Threat Intelligence solution? ESET s Threat Intelligence service provides global knowledge on targeted
Seceon s Open Threat Management software
Seceon s Open Threat Management software Seceon s Open Threat Management software (OTM), is a cyber-security advanced threat management platform that visualizes, detects, and eliminates threats in real
Cisco Cloud Security. How to Protect Business to Support Digital Transformation
Cisco Cloud Security How to Protect Business to Support Digital Transformation Dragan Novakovic Cybersecurity Consulting Systems Engineer January 2018. Security Enables Digitization Digital Disruption,
OUTSMART ADVANCED CYBER ATTACKS WITH AN INTELLIGENCE-DRIVEN SECURITY OPERATIONS CENTER
OUTSMART ADVANCED CYBER ATTACKS WITH AN INTELLIGENCE-DRIVEN SECURITY OPERATIONS CENTER HOW TO ADDRESS GARTNER S FIVE CHARACTERISTICS OF AN INTELLIGENCE-DRIVEN SECURITY OPERATIONS CENTER 1 POWERING ACTIONABLE
THE WOMBAT API handling incidents by querying a world-wide network of advanced honeypots
THE WOMBAT API handling incidents by querying a world-wide network of advanced honeypots Piotr Kijewski, Adam Kozakiewicz 15th June 2010 22nd Annual FIRST Conference, Miami WOMBAT Project EU 7th FRAMEWORK
Security in AI. Alex Healing Senior Research Manager BT Applied Research. British Telecommunications plc 2019
Security in AI Alex Healing Senior Research Manager BT Applied Research 1 AI and Security AI and Security 2 3 4 Saturn: intelligent interactive data analytics Give the users the control to do what they
New Developments in the SpamPots Project
New Developments in the SpamPots Project Klaus Steding-Jessen Cristine Hoepers CERT.br CERT Brazil http://www.cert.br/ NIC.br Brazilian Network Information Center http://www.nic.br/
align security instill confidence
align security instill confidence cyber security Securing data has become a top priority across all industries. High-profile data breaches and the proliferation of advanced persistent threats have changed
Cisco Firepower NGFW. Anticipate, block, and respond to threats
Cisco Firepower NGFW Anticipate, block, and respond to threats You have a mandate to build and secure a network that supports ongoing innovation Mobile access Social collaboration Public / private hybrid
SIEM (Security Information Event Management)
SIEM (Security Information Event Management) Topic: SECURITY and RISK Presenter: Ron Hruby Topics Threat landscape Breaches and hacks Leadership and accountability Evolution of security technology What
Security Monitoring. Managed Vulnerability Services. Managed Endpoint Protection. Platform. Platform Managed Endpoint Detection and Response
Security Operations Flexible and Scalable Solutions to Improve Your Security Capabilities Security threats continue to rise each year and are increasing in sophistication and malicious intent. Unfortunately,
Botnets Behavioral Patterns in the Network
Botnets Behavioral Patterns in the Network Garcia Sebastian @eldracote Hack.Lu 2014 CTU University, Czech Republic. UNICEN University, Argentina. October 23, 2014 How are we detecting malware and botnets?
Intrusion prevention systems are an important part of protecting any organisation from constantly developing threats.
Network IPS Overview Intrusion prevention systems are an important part of protecting any organisation from constantly developing threats. By using protocol recognition, identification, and traffic analysis
We re Gonna Need a Bigger Boat
SESSION ID: CSV-F01 We re Gonna Need a Bigger Boat Alan Ross Senior Principal Engineer Intel Corporation Grant Babb Research Scientist Intel Corporation IT Analytics: All about the changing Enterprise
Security activities in Japan towards the future standardization. Cybersecurity
Security activities in Japan towards the future standardization Side Event Cybersecurity Koji NAKAO KDDI, Japan Content Current threats - Internet User in Japan - However, observation of many scans (by
Security analytics: From data to action Visual and analytical approaches to detecting modern adversaries
Security analytics: From data to action Visual and analytical approaches to detecting modern adversaries Chris Calvert, CISSP, CISM Director of Solutions Innovation Copyright 2013 Hewlett-Packard Development
Botnet Detection Using Honeypots. Kalaitzidakis Vasileios
Botnet Detection Using Honeypots Kalaitzidakis Vasileios Athens, June 2009 What Is Botnet A Botnet is a large number of compromised computers, controlled by one or more Command-and-Control Servers, the
Colin Gibbens Director, Product Management
SOAR = Human Intelligence and Creativity at Speed of Machine Abhishek Narula EVP, Head of Product and Engineering Colin Gibbens Director, Product Management 1 2 What is Security Orchestration Why do I
Putting security first for critical online brand assets. cscdigitalbrand.services
Putting security first for critical online brand assets cscdigitalbrand.services 2 As the most security conscious digital brand service provider, our clients trust us to take care of their businesses and
Internet Continuous Situation Awareness
Internet Continuous Situation Awareness Prof. Dr. Norbert Pohlmann Institute for Internet Security - if(is) University of Applied Sciences Gelsenkirchen http://www.internet-sicherheit.de Content Structure
Orchestrating and Automating Trend Micro TippingPoint and IBM QRadar
Orchestrating and Automating Trend Micro TippingPoint and IBM QRadar Response Automation SOCAutomation is an information security automation and orchestration platform that transforms incident response.
Centre for cybersecurity Belgium : Role, Missions et future capacities
Centre for cybersecurity Belgium : Role, Missions et future capacities NLO meeting 30/01/2018 Phédra Clouner Deputy Director CCB 01 CCB mission & services Page 2 Legal Basis R.D. 10/10/2014 Contribute
ENDNOTE SECURITY OVERVIEW INCLUDING ENDNOTE DESKTOP AND ONLINE
ENDNOTE SECURITY OVERVIEW INCLUDING ENDNOTE DESKTOP AND ONLINE INTRODUCTION In line with commercial industry standards, the data center used by EndNote employs a dedicated security team to protect our
The Future of Threat Prevention
The Future of Threat Prevention Bricata is the leading developer of Next Generation Intrusion Prevention Systems (NGIPS) technology, providing innovative, disruptive, high-speed, high-performance network
Configuring BIG-IP ASM v12.1 Application Security Manager
Course Description Configuring BIG-IP ASM v12.1 Application Security Manager Description The BIG-IP Application Security Manager course gives participants a functional understanding of how to deploy, tune,
Detect & Respond to IoT Botnets AS AN ISP. Christoph Giese Telekom Security; Cyber DefenSe Center
Detect & Respond to IoT Botnets AS AN ISP Christoph Giese Telekom Security; Cyber DefenSe Center Management Summary Mirai hit us hard; IoT Botnets are on the rise and rapidly evolving We developed a three-stage
ForeScout Extended Module for Carbon Black
ForeScout Extended Module for Carbon Black Version 1.0 Table of Contents About the Carbon Black Integration... 4 Advanced Threat Detection with the IOC Scanner Plugin... 4 Use Cases... 5 Carbon Black Agent
Beyond a sensor. Towards the Globalization of SURFids. FIRST 20 th Annual Conference Vancouver, Canada
Beyond a sensor Towards the Globalization of SURFids Wim.Biemolt@surfnet.nl FIRST 20 th Annual Conference Vancouver, Canada 1 SURFnet6 2 SURFcert 3 18 th Annual FIRST Conference Goals - Understanding:
RSA INCIDENT RESPONSE SERVICES
RSA INCIDENT RESPONSE SERVICES Enabling early detection and rapid response EXECUTIVE SUMMARY Technical forensic analysis services RSA Incident Response services are for organizations that need rapid access
Tracking Evil with Passive DNS
Tracking Evil with Passive DNS Bojan Ždrnja, CISSP, GCIA, GCIH Bojan.Zdrnja@infigo.hr INFIGO IS http://www.infigo.hr Who am I? Senior information security consultant with INFIGO IS (Croatia) Mainly doing
<Partner Name> RSA NETWITNESS Intel Feeds Implementation Guide. Kaspersky Threat Feed Service. <Partner Product>
RSA NETWITNESS Intel Feeds Implementation Guide Kaspersky Jeffrey Carlson, RSA Partner Engineering Last Modified: December 19 th, 2017 Solution Summary Kaspersky Lab offers
Course Outline Topic 1: Current State Assessment, Security Operations Centers, and Security Architecture
About this Course This course will best position your organization to analyse threats and detect anomalies that could indicate cybercriminal behaviour. The payoff for this new proactive approach would
Building Resilience in a Digital Enterprise
Building Resilience in a Digital Enterprise Top five steps to help reduce the risk of advanced targeted attacks To be successful in business today, an enterprise must operate securely in the cyberdomain.
Synchronized Security
Synchronized Security 2 Endpoint Firewall Synchronized Security Platform and Strategy Admin Manage All Sophos Products Self Service User Customizable Alerts Partner Management of Customer Installations
Application Security. Rafal Chrusciel Senior Security Operations Analyst, F5 Networks
Application Security Rafal Chrusciel Senior Security Operations Analyst, F5 Networks r.chrusciel@f5.com Agenda Who are we? Anti-Fraud F5 Silverline DDOS protection WAFaaS Threat intelligence & malware
Dynamic Risk Management for Cyber Defence
Dynamic Risk Management for Cyber Defence Douglas Wiemer Director, Cyber Security Solutions FP7 Project number 610416 RHEA Group Consortium Participants The User agency: Acea Group Founded in 1909 as the
Un SOC avanzato per una efficace risposta al cybercrime
Un SOC avanzato per una efficace risposta al cybercrime Identificazione e conferma di un incidente @RSAEMEA #RSAEMEASummit @masiste75 Mauro Costantini - Presales Consultant Agenda A look into the threat
Building an Effective Threat Intelligence Capability. Haider Pasha, CISSP, C EH Director, Security Strategy Emerging Markets Office of the CTO
Building an Effective Threat Intelligence Capability Haider Pasha, CISSP, C EH Director, Security Strategy Emerging Markets Office of the CTO The Race To Digitize Automotive Telematics In-vehicle entertainment
Threat Centric Network Security
BRKSEC-2056 Threat Centric Network Security Ted Bedwell, Principal Engineer Network Threat Defence Cisco Spark How Questions? Use Cisco Spark to communicate with the speaker after the session 1. Find this
The SANS Institute Top 20 Critical Security Controls. Compliance Guide
The SANS Institute Top 20 Critical Security Controls Compliance Guide February 2014 The Need for a Risk-Based Approach A common factor across many recent security breaches is that the targeted enterprise
Integrated, Intelligence driven Cyber Threat Hunting
Integrated, Intelligence driven Cyber Threat Hunting THREAT INVESTIGATION AND RESPONSE PLATFORM Zsolt Kocsis IBM Security Technical Executive, CEE zsolt.kocsis@hu.ibm.com 6th Nov 2018 Build an integrated
WP2 Metrics of Cyber Security
WP2 Metrics of Cyber Security WP2 Athens March 2018 CYBE Presented by: Jart Armin This work is performed within the SAINT Project (Systemic Analyser in Network Threats), with the support of the European
RSA Security Analytics
RSA Security Analytics This is what SIEM was Meant to Be 1 The Original Intent of SIEM Single compliance & security interface Analyze & prioritize alerts across various sources The cornerstone of security
ANATOMY OF AN ATTACK!
ANATOMY OF AN ATTACK! Are Your Crown Jewels Safe? Dom Kapac, Security Evangelist WHAT DO WE MEAN BY CROWN JEWELS? Crown jewels for most organizations are critical infrastructure and data Data is a valuable
How Boards use the NIST Cybersecurity Framework as a Roadmap to oversee cybersecurity
How Boards use the NIST Cybersecurity Framework as a Roadmap to oversee cybersecurity Why is the NIST framework important? GOH Seow Hiong Executive Director, Global Policy & Government Affairs, Asia Pacific
Machine-Powered Learning for People-Centered Security
White paper Machine-Powered Learning for People-Centered Security Protecting Email with the Proofpoint Stateful Composite Scoring Service www.proofpoint.com INTRODUCTION: OUTGUNNED AND OVERWHELMED Today
CloudSOC and Security.cloud for Microsoft Office 365
Solution Brief CloudSOC and Email Security.cloud for Microsoft Office 365 DID YOU KNOW? Email is the #1 delivery mechanism for malware. 1 Over 40% of compliance related data in Office 365 is overexposed
SURVEY ON NETWORK ATTACK DETECTION AND MITIGATION
SURVEY ON NETWORK ATTACK DETECTION AND MITIGATION Welcome to the da/sec survey on network attack detection and mitigation. Network-based attacks pose a strong threat to the Internet landscape and academia
The Interactive Guide to Protecting Your Election Website
The Interactive Guide to Protecting Your Election Website 1 INTRODUCTION Cloudflare is on a mission to help build a better Internet. Cloudflare is one of the world s largest networks. Today, businesses,
What can we lose not implementing proper security in our IT environment? Aleksandar Pavlovic Security Account Manager Cisco
What can we lose not implementing proper security in our IT environment? Aleksandar Pavlovic Security Account Manager Cisco Increasing Digital Traffic Creates a Greater Attack Surface Global IP Traffic
The Next Generation Security Platform. Domenico Stranieri Pre- Sales Engineer Palo Alto Networks EMEA Italy
The Next Generation Security Platform Domenico Stranieri Pre- Sales Engineer Palo Alto Networks EMEA Italy The Next Generation Enterprise Security Platform Core Value Proposition An Enterprise Security