Reporting against any framework is a difficult and time consuming task often utilising multiple staff and burdening multiple teams. Splunk App for Essential 8 reduces the impact by automating reporting and providing one location to measure maturity. If you are spending more time on reporting than implementing the controls for E8, reach out to your local Splunk team or Splunk partner so we can help you get ahead of the challenge.

1. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Splunk For the Essential 8
December 2017 | Version 1.1

2. © 2017 SPLUNK INC.
During the course of this presentation, we may make forward-looking statements regarding future events or
the expected performance of the company. We caution you that such statements reflect our current
expectations and estimates based on factors currently known to us and that actual events or results could
differ materially. For important factors that may cause actual results to differ from those contained in our
forward-looking statements, please review our filings with the SEC.
The forward-looking statements made in this presentation are being made as of the time and date of its live
presentation. If reviewed after its live presentation, this presentation may not contain current or accurate
information. We do not assume any obligation to update any forward-looking statements we may make. In
addition, any information about our roadmap outlines our general product direction and is subject to change
at any time without notice. It is for informational purposes only and shall not be incorporated into any contract
or other commitment. Splunk undertakes no obligation either to develop the features or functionality
described or to include any such feature or functionality in a future release.
Splunk, Splunk>, Listen to Your Data, The Engine for Machine Data, Splunk Cloud, Splunk Light and SPL are trademarks and registered trademarks of Splunk Inc. in
the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners. © 2017 Splunk Inc. All rights reserved.
Forward-Looking Statements

3. © 2017 SPLUNK INC.
Australian Signals Directorate
Essential 8 - Overview

4. © 2017 SPLUNK INC.
▶ To prevent malware running
• Application whitelisting
• Patch applications
• Disable untrusted Microsoft office macros
• User application hardening
▶ To limit the extent of incidents and recover data
• Restrict administrative privileges
• Patch operating systems
• Multi factor authentication
• Daily backup of important data
The Essential 8 Controls

5. © 2017 SPLUNK INC.
ASD Maturity Level

6. © 2017 SPLUNK INC.
ASD Maturity Level Continued

7. © 2017 SPLUNK INC.
Splunk helps inform
implementation of the Essential 8

8. © 2017 SPLUNK INC.
▶ Each agency is mandated to report on compliance against the Essential 8 to one of the
following parties
• Internal audit
• External audit (ANAO and IRAP assessors)
• Physical security (PSPF compliance)
• Executive (Visibility)
▶ The Splunk app aids reporting in several areas:
• How are you enforcing the control?
• Can you confirm all of the applicable hosts mentioned in the Statement of Applicability have the
control enforced?
• Can this control be bypassed?
• Can you provide me a sample output of the hosts with this control enforced?
▶ The Splunk app does not enforce the controls or document them
Reporting Requirements

9. © 2017 SPLUNK INC.
1. Vendor agnostic data input
2. Include industry audit expertise
3. Relevant to current audit rounds
4. Flexible enough to adopt new features or
audit requirements
5. Align maturity to a known standard
6. Must be open source and free to install
Requirements of the
Essential 8 App
Our Decision
Tree

10. © 2017 SPLUNK INC.
Reporting - it’s not that hard!

11. © 2017 SPLUNK INC.
▶ Department with 700 Staff
▶ 1000 servers
▶ 700 desktops
▶ Reporting – What auditors are asking:
• How many privileged administrators do you have?
• For each privileged administrator do you have a corresponding authorisation form?
• Show me a sample of these users in your privileged admin list and their activities?
• Do any of these users have passwords that never expire?
• How many privileged accounts do you have vs staff?
• How many of these privileged administrators have database administrator privileges?
• Have any of these administrators performed actions on their own account?
• .. and so on
Example Run Through of Reporting – Privileged
Administrators

12. © 2017 SPLUNK INC.
Splunk App For ASD Essential 8

13. © 2017 SPLUNK INC.
Why Splunk for ASD E8 Reporting
Rapid investigation
to audit questions
Implementation in
weeks not years
Historical
reporting
Can take any data
source
Continuous
visibility

14. © 2017 SPLUNK INC.
Tier
1
Chief Information Security Officer / Chief Information Officer
Wants a high level view of their agencies maturity
IT Security Advisor
Needs to have enough information to task operations teams to improve compliance
Auditors
Have enough detail to validate controls
Security Operations
Need to know details on how to improve controls (raw data)
An app for all security roles

15. © 2017 SPLUNK INC.
▶ The Essential 8 app will leverage the maturity model to measure the
organisations
▶ Scale from 0 to 100
▶ Excludes maturity level 4 – Required for environments with higher security
requirements
Mapping to the maturity level
Maturity Level 0 Maturity Level 1 Maturity Level 2 Maturity Level 3
0 - 0 1 - 35 36 - 70 70 - 100

16. © 2017 SPLUNK INC.
▶ Designed to work on Splunk Enterprise
• Requires data that relates to each control
• Available in 'alpha release’ at
• https://github.com/secops4thewin/asdes
sential8app
▶ Splunk Enterprise Security helps fast
track implementation
• Data models
• Risk framework
• Allows you to assign risk rating to hosts and
users
• Asset and identity framework
• Allows you to detail which users should have
Multi factor authentication and which hosts
require application whitelisting.
Prerequisites
Splunk Enterprise or Splunk Enterprise Security?

17. © 2017 SPLUNK INC.
Essential 8 Example
Dashboards
A sample of screenshots

18. © 2017 SPLUNK INC.
Application Whitelisting Overview

19. © 2017 SPLUNK INC.
User Application Hardening

20. © 2017 SPLUNK INC.
Restrict Admin Privileges

21. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Thank You