Your SlideShare is downloading. ×

Thanks for flagging this SlideShare!

Oops! An error has occurred.

×
Saving this for later? Get the SlideShare app to save on your phone or tablet. Read anywhere, anytime – even offline.
Text the download link to your phone
Standard text messaging rates apply

Big Data is Old School – Endpoint Intelligence is the New Information Security

311
views

Published on

To learn more about Unisys Stealth visit: http://www.unisys.com/stealth …

To learn more about Unisys Stealth visit: http://www.unisys.com/stealth

Explore Unisys CISO Dave Frymier's recent presentation from the RSA Conference in San Fransisco.

It’s time to let go of intelligence inside the network. Shifting to endpoint intelligence is not only more effective, it’s less costly. This shift can also help organizations immediately identify if information has been compromised.

Published in: Technology

0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total Views
311
On Slideshare
0
From Embeds
0
Number of Embeds
1
Actions
Shares
0
Downloads
5
Comments
0
Likes
0
Embeds 0
No embeds

Report content
Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
No notes for slide

Transcript

  • 1. Big Data InfoSec Should Be Dead David Frymier Vice President and CISO, Unisys
  • 2. Two Big Drivers IT Environment Consumerization of IT • New devices are everywhere; employees will use them – Consumer devices are not generally MS domain aware • Not just about devices—new services on the Internet tunnel port 80 – gotomyPC, logmein – Dropbox • Organizational perimeter crumbling © 2014 Unisys Corporation. All rights reserved. 2
  • 3. Advanced Persistent Threat • Enters through spam e-mail, bad websites • “Beacons” back to command and control servers – Reports in – Obtains instructions/more malware • Evades anti-malware software • Low and slow • Looks laterally and vertically in network for high value targets • Can be found through beaconing activity Corporate Jewels Enterprise Administration (Active Directory) Departmental infrastructure Random spam Spear phishing Bad web site Botnet C&C © 2014 Unisys Corporation. All rights reserved. 3
  • 4. Security Monitoring Model – SIEM Current countermeasures Portal Network Security Services Asset Inventory and Vulnerability Scanning Portal Security Incident Management Dashboard & Reports Assets and Vulnerabilities Intrusion Detection & Prevention Network Firewall & VPN Web Content Security Vulnerability Mgmt. Threat & Vulnerablity Alerting Endpoint Security Unisys or Customer Ticketing System Event Correlation Engine Incidents Portal Threat Pattern Database Event Database Response and Remediation Portal Normalization of Element-specific log file data Secure Remote Access Web Application Security Portal Reporting Security Event Monitoring Email Scanning Portal Threat and Vulnerability Alerting Application Security Services Scanner Portal Elementspecific Agents Elementspecific Agents Elementspecific Agents Security Infrastructure; Network Devices; OS, Application and Data Logs Unisys Monitored or Managed Security Elements Customer Managed Security Elements © 2014 Unisys Corporation. All rights reserved. 4
  • 5. SIEM • It’s mostly after-the-fact • Protects everything the same way • Getting more and more expensive—like big data – Software costs – Storage of all the log and traffic data/meta data – Processing – Network resources to move data from endpoint to SIEM For advanced adversaries, the traditional approach just isn’t working. The New York Times article retrieved from www.nytimes.com © 2014 Unisys Corporation. All rights reserved. 5
  • 6. How is this possible? • The real world follows the laws of physics— the cyber world follows manmade rules that govern the transfer of data • We forget how young the Internet is; it grew like a weed—without much change in the underlying protocols • Standardization cuts both ways • There are fundamental design flaws – Anonymity and spoofing • Software has bugs This is not going to be fixed quickly. © 2014 Unisys Corporation. All rights reserved. 6
  • 7. SNOWDEN Encryption works. Properly implemented strong crypto systems are one of the few things that you can rely on. Edward Snowden Interview with Guardian readers, June 2013 © 2014 Unisys Corporation. All rights reserved. 7
  • 8. What is Unisys Stealth™? • Software, running on Windows and Linux computers • FIPS 140-2 AES-256 certified cryptography module • Provides compartmentalized security by implementing virtual communities of interest (COI) for predetermined endpoint users • Authenticates and authorizes users based on identity, not network topology • Because it executes between the network and link protocol layers, it has no effect on applications or existing networks • Makes systems undiscoverable by attackers • Supports “clear COI” to allow for incremental integration into existing environments 7. Application 6. Presentation 5. Session 4. Transport 3. Network Stealth Shim 2. Link 1. Physical NIC © 2014 Unisys Corporation. All rights reserved. 8
  • 9. Stealth Application compartmentalization for a Web Application • Because Stealth is software, it can be deployed with: – no network changes (no cabling, no VLAN or LAN changes, no firewall rules) – no application changes— either code or configuration • … and if you chose to install just the data center components, it can be done with: – no end-user impact— or even awareness © 2014 Unisys Corporation. All rights reserved. 9
  • 10. Thank You David Frymier, Vice President and CISO, Unisys Corporation Questions? Contact: stealth@unisys.com

×