The Security Kung Fu Series was created as both a thought leadership and awareness campaign which ran from Q1 – Q2 2017. It was meant to educate attendees on the internal and external threats businesses face, and the compliance challenges many must endure. It also served to highlight the need for an array of software solutions from the SolarWinds Core IT Security Portfolio which can assist with these concerns. A primary focus of the event was SolarWinds® Log & Event Manager which can contribute to greater IT security and assist businesses in meeting and maintaining compliance with a variety of compliance regimes. Part 1: SIEM Solutions In Part 1, we took an in-depth look at the cybersecurity climate businesses and currently facing and educated ourselves on the cybercrime industry as a whole. Using the Lockhead Martin Cyber Kill Chain® as an example, we discussed the role SIEM solutions play in identifying security threats and discussed the unique capabilities of such solutions to allow users to go back in time to conduct forensic analysis of security incidents and verified threats. Other Security Kung Fu Events: Part 2: Firewall Logs | http://bit.ly/2ql3l2A Part 3: Active Directory Changes | http://bit.ly/2s5kFFc Part 4: Security vs. Compliance | http://bit.ly/2qXuc3I If you are interested in learning about the impact of this campaign, please visit my LinkedIn Profile for more details or feel free to reach out to me directly over LinkedIn. Acknowledgements I’d like to thank the following individuals for assisting me in the execution of this campaign: Justina Lister, Angeline Kelly, Jamie Hynds, Ian Trump, Destiny Bertucci, Curtis Ingram, Chris Wiley, Ren Penaflor, Allie Eby, Ann Guidry, Rainy Schermerhorn, Kirsten Tanges, Damon Garcia

2. INTRODUCTION
The Security Kung Fu Series is a four-part series intended to guide you in the mastery of the art of
Security Kung Fu.
As we embarked on creating this series, we always knew that in the back of everyone’s minds were a
couple of curious thoughts: Why “Kung Fu?” And, “what does martial arts have to do with how I protect
my network?”
Well, “Kung Fu” is a Chinese term referring to any study, learning, or practice that requires patience,
energy, hard work, discipline and time to complete. So, really, it’s not just martial arts.
Perhaps, by this definition, you’re starting to see the parallels we see with IT security, and the vital roles
many of you play within your respective organizations.
For on demand access to each recording of the series visit the Security Kung Fu Series Page.
© 2017 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED. 1

3. AGENDA
• Respect your Security Kung Fu Masters
• Discuss the cybersecurity battleground
• IT security stances
• The need for a layered approach
• SIEM solutions - security and compliance
• Intro to SolarWinds® Log & Event Manager (LEM)
• Q&A
© 2017 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED. 2

4. SECURITY KUNG FU MASTERS
© 2017 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED. 3
Curtis Ingram
Sales Engineer, SolarWinds
Ian Trump
Cyber Security Strategist

5. THE CYBER SECURITY CLIMATE
© 2017 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED. 4

6. THE CYBER SECURITY CLIMATE
© 2017 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED. 5
$75 BILLION
$170 BILLION
$2 TRILLION

7. CYBER CRIME INDUSTRY
• The mature Crime-as-a-Service model underpinning cyber-crime continues to provide tools
and services across the entire spectrum of cyber criminality, from entry-level to top-level
players, including terrorists.
• The boundaries between cyber criminals, Advanced Persistent Threat (APT) style actors
and other groups continue to blur.
• The availability of cybercrime tools and services, and illicit commodities such as DDoS on
the Darknet, provide ample opportunities for traditional crime to become cyber enabled.
• Ransomware and banking Trojans remain top malware threats.
© 2017 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED. 6
Source: 2016 Internet Organised Crime Threat Assessment (IOCTA), EUROPOL

8. RECENT EXAMPLE
• IAT HONG, BO ZHENG, and CHIN HUNG
© 2017 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED. 7
Source: https://www.sec.gov/litigation/litreleases/2016/lr23711.htm

9. IT SECURITY STANCES
© 2017 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED. 8
PROACTIVE DETECTIVE REACTIVE-RECOVERY

10. PROACTIVE STANCE
• 1/3 of the best defense is to prevent breaches
altogether
o Perimeter security measures like firewalls
o Anti-virus, anti-malware, web protection, patch
management
o Harden endpoints “cyber hygiene”
o Policies/Procedures, User Awareness Training
© 2017 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED. 9

11. DETECTIVE STANCE
• 2/3 of an effective defense
o When cyber criminals are successful; there is a
requirement to catch them before data ex-filtration
takes place.
o Network layer detections, machine heuristics,
machine behavior-based metrics
o Host Intrusion Detection System
o Network Intrusion Detection System
© 2016 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED. 10

12. REACTIVE-RECOVERY STANCE
• 3/3 Restore business services
o Ransomware is the “simple” threat
o APT actors will establish footholds and move
latterly
o May require Incident Response; PR Legal, etc.
o Answer what was taken, how it was taken?
© 2017 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED. 11

13. RECENT EXAMPLES
• AUSTRAILIA’S RED CROSS® BLOOD SERVICES
© 2017 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED. 12
Source: http://theconversation.com

14. THE LAYERED SECURITY APPROACH
© 2017 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED. 13
Delivery Exploitation Installation C2 Actions
WAN to LAN End Point End Point LAN to WAN End Point
Lockheed Martin Cyber Kill Chain®

15. THE NEED FOR SIEM SOLUTIONS
• Gives you visibility in an area that is critical to your business “Threat Hunting”
• Only solution with forensic feature to go back in time
• Required for compliance and providing evidence for security audits
• Uncovers unauthorized changes in the environment
• Detects insider threats such as data ex-filtration
• Provides a record of network layer activity, correlated with machine data and
ultimately user behavior
© 2017 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED. 14

16. SOLARWINDS LOG & EVENT MANAGER
SolarWinds® Log & Event Manager is an affordable SIEM solution that helps you
detect and respond to security threats.
• Real-time event correlation for instantaneous detection of malicious and suspicious
activity
• Automated remediation and advanced search for forensic analysis and
troubleshooting
• Out-of-the-box compliance rules and reports for HIPAA, PCI, SOX, FISMA, and may
more.
Download Free Trial | Learn More
5/26/2017 © 2017 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED. 15

18. SECURITY KUNG FU WEBINAR SERIES
© 2017 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED. 17
The SolarWinds, SolarWinds & Design, Orion, and Thwack trademarks are the exclusive
property of SolarWinds Worldwide, LLC or its affiliates, are registered with the U.S. Patent
and Trademark Office, and may be registered or pending registration in other countries. All
other SolarWinds trademarks, service marks, and logos may be common law marks or are
registered or pending registration. All other trademarks mentioned herein are used for
identification purposes only and are trademarks of (and may be registered trademarks) of
their respective companies.