EVOLVED REQUIREMENTS
A Business-Driven Security Strategy for Threat
Detection & Response
Phil Owens
Sr. Systems Engineer, Threat Detection & Response
[email protected]
1
THE CHALLENGE FOR
SECURITY TEAMS
2
ATTACKERS QUICKLY TURN COMPROMISES
INTO BREACHES
Minutes
Hours
Days
Weeks
Months
Breach
Detected
Breach
Initial compromise
3rd Party
Detection
Spear Phishing
Attack
Malware
Installed
82%
Communicate to
External Server
(C2)
compromised in
MINUTES
Lateral
Movement
Discover
Critical Assets
99%
Data
Exfiltration
of exfiltration
occurred in DAYS
Breach
Detected
64%
discovered in
MONTHS
3
LOGS PROVIDE ONLY LIMITED VISIBILITY
NetFlow Analyzer sees
lateral movement but
from a known user
NGFW has no
rule for/against
threat traffic
NGFW
AV misses user
downloading
Unknown Malware
IDS / IPS
IPS has no
signature to stop
the threat traffic
NGFW
Malware Tool misses
UNKNOWN, NEW
threat
Confidential
Data
NGFW has no
rule for/against
threat traffic
VMs further
inhibit visibility
into threats
Visibility into Threats in the
Cloud is an even bigger
challenge
4
THE FLOOD OF DATA FROM OTHER SOURCES CAN
BE OVERWHELMING
The need for
visibility drives
organizations to
add more data
sources
SIEM / Logs
NetFlow Collector / NBAD
!
!
But too much data
from disparate
sources can
obfuscate real
threats
!
!
!
!
!
! ! !
!
! !
!
Full PCAP / Network
Forensics
Endpoint Security
Data Capture across Cloud
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
! ! !
! !
!
!
!
!
!
!
!
!
!
!
Manual correlation and analysis make it
NEARLY IMPOSSIBLE to respond in
time and prevent breaches
5
SECURITY TEAMS STRUGGLE TO ASSESS AND
ACT
Is this a real incident?
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
?
•
Did any new processes execute on the
target?
•
Were there any communications back to
the attacker?
What’s the scope of the incident?
• Based on the initial incident, are there other
systems affected?
What’s the impact of the incident?
•
What data was exfiltrated?
What actions are required to
mitigate?
6
ENSURING YOUR
SIEM FINDS THE
ATTACKS THAT
MATTER MOST
7
REQUIREMENTS FOR SIEM HAVE EVOLVED
Evolved Threat
Landscape
Modern IT
Infrastructure
Noise in the
System
Automated, targeted,
persistent attacks
Erosion of the
perimeter
Humans can’t keep
up, focus
8
RESULT: YOU CAN’T KEEP ALL THE BAD GUYS OUT
THE LONGER THEY ARE IN,
THE HIGHER THE RISK
ACCELERATE
DETECTION &
RESPONSE
Risk
Dwell Time
9
REQUIREMENTS FOR AN EVOLVED SIEM
OPTIMIZED FOR THREAT DETECTION & RESPONSE
Visibility Beyond Logs
Breadth of Analytics
Methods to Detect
Attack Campaigns
Rapid Ability to
Understand &
Respond to Full Scope
of Incident
Ability to Integrate
Detection & Response
with Business Risk
10
TRANSFORMING SECURITY STRATEGY: TWO
FUNDAMENTAL AREAS OF FOCUS
T R A N S F O R M AT I O N A L
S E C U R I T Y S T R AT E G Y
Make Security Teams
More Operationally
Impactful
More Strategically
Manage
Cyber Risk
11
AN EVOLVED SIEM IS NEEDED
BROADEST SOURCES
OF VISIBILITY
PRIORITIZED RESPONSE
ANALYTICS ENGINE
•
PACKETS
•
LOGS
•
ENDPOINT
Attack
•
THREAT INTELLIGENCE
Insight
•
NETFLOW
•
CLOUD
•
BUSINESS CONTEXT
•
Utilize asset criticality and
identity information to
prioritize the threats that
matter most
•
Capabilities aligned to
requirements – focus on
prioritization and speed of
TD&R
•
Feed business context and
identity to minimize noise
Deepest
12
INCLUSION &
EXCLUSION
SECURITY
TECHNOLOGY
BUSINESSDRIVEN
SECURITY
BUSINESS
RISK
MANAGEMENT
LINK SECURITY INCIDENTS WITH BUSINESS CONTEXT
T O R E S P O N D FA S T E R A N D P R O T E C T W H AT M AT T E R S M O S T
13
THANK YOU
14