vip_day_2._1130_cloud

© Copyright 2013 EMC Corporation. All rights reserved. 1
UNLOCKING THE FUTURE ENTERPRISE 2013
The session is about to commence. Please switch your phone to silent!

Defend with
Confidence
Against Advanced
Threats
Nicholas Chia
SE Manager,
SEA RSA

TRUST? Years to earn, seconds to break

Market Disruptors
Infrastructure Transformation
Mobile
Cloud
Less control over access device and back-end infrastructure
Threat Landscape Transformation
APTs
Sophisticated Fraud
Fundamentally different tactics, more formidable than ever
Business
Transformation
More hyper-extended, more digital
Extended Workforce
Networked Value Chains
Big Data

Speed
Response Time
2
Decrease
Dwell Time
1
TIME
Attack Identified
Response
System
Intrusion
Attack Begins
Cover-Up Complete
Advanced Threats Are Different
Cover-Up Discovery
Leap Frog Attacks
1
TARGETED
SPECIFIC OBJECTIVE
STEALTHY
LOW AND SLOW
2
3
INTERACTIVE
HUMAN INVOLVEMENT
Dwell Time
Response Time

CRIMINALS
Unsophisticated, but noisy
Organized, sophisticated supply chains (PII, PCI, financial services, retail)
Organized crime
Petty criminals
NON-STATE ACTORS
Various reasons, including collaboration with the enemy
Political targets of opportunity, mass disruption, mercenary
Cyber-terrorists / Hacktivists
Insiders
NATION STATE ACTORS
Government, defense industrial base, IP rich organizations, waterholes
Nation states
Who Are you Dealing with?

Organisations view of their security
Prevention FTW!!!!

What It Looks Like to the Advance Adversaries
loopholes
loopholes

INCIDENT RESPONSE It starts with identifying the incident

Resource Shift: Budgets and People
Today’s Priorities
Prevention
80%
Monitoring
15%
Response
5%
Prevention
33%
Intelligence-Driven Security
Monitoring
33%
Response
33%

ALERT!!... Multiple indicators to escalate a potential incident
Days of Investigation Completed In Hours
Session Recreated To Investigate
Incident Management Initiated
4
●●●●●●●●
PASSWORD
Additional Context Answers More Questions

Shift
Handoff
SOC
Manager
Network
Manager
CISO
Finance
Legal
Incident
Process
Threat
Analysis
Report
KPIs
Breach
Process
IT
Handoff
Centralize
Alerts
Measure
Efficacy
SOC
Analyst
Breach
Coordinator
HR
IT
Malware
Analyst
Threat
Analyst
SIEM
DLP
Network
Visibility
eFraud
Host
Visibility
Security is Complex!

People : Advanced Cyber Defense Training

Incident
Management
Threat
Intelligence
Management
Breach
Management
SOC
Program
Management
IT Security
Risk
Management
Process : RSA Security Operations
User Personas
Security Operations Management
Persona Driven Design
Business-driven Security Operations Management
SOC Analysts
L1 Analyst
L2 Analyst
Threat Intel Analyst
SOC Management
SOC Manager
CISO/CSO
Cross Functional Teams
CIO
Business Mgr.
Privacy Officer
Compliance
Legal
HR

TECHNOLOGY : Advanced Security Ops Center
RSA Live Intelligence
Threat Intelligence – Rules – Parsers – Alerts – Feeds – Apps – Directory Services – Reports and Custom Actions
RSA Security Analytics
SharePoint
File Servers
Databases
NAS/SAN
Endpoints
RSA Data Discovery
Enabled by
RSA DLP
RSA
ECAT
RSA Security Operations Management
Windows Clients/Servers
Asset Context
Incident
Management
Vulnerability Risk Management
Security Operations Management
Capture Time Data Enrichment
Distributed Data Collection
LIVE
LIVE

RSA Security Analytics Malware Analysis
•
Integrated workflow streams enables you to see the before, during and after an event
•
Allows customization of the analytical scoring logic

SHOW ME THE BIG DATA

Big Data Security Challenges
1.
Big Data Infrastructure
2.
Common Meta-Framework
3.
Analytic Applications
Packet collection & processing
Log collection & processing
Hadoop
Ip.source
src_ip
Source_IP
Ip-source
COMMON META FRAME WORK
HIVE
PIG
R
MAHOUT
HAWQ
Analytic Application
Machine Learning
Predictive Analytics
Neural Networks
Database
ETL
ETL
FAIL

BIG DATA Use Cases
•
Blacklist IP Generator
–
Identify new traffic that behaviorally consistent in traffic patterns to a known command-and-control IP
•
Social Network Analyzer
–
Discover closely clustered communication events that is known to be associated with infected unmanaged devices and dynamic command-and-control structure
•
Machine Generated Domain Detector
–
Measure readability of domain names to detect malware that uses domain generation algorithm

Comprehensive Visibility “See everything happening in my environment and normalize it”
High Powered Analytics “Give me the speed and smarts to detect, investigate and prioritize potential threats”
Big Data Infrastructure “Need a fast and scalable infrastructure to conduct real time and long term analysis”
Today’s Security Requirements
Integrated Intelligence “Help me understand what to look for and what others have discovered”

Nicholas.Chia@RSA.com

vip_day_2._1130_cloud

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Viewers also liked

Viewers also liked (15)

Similar to vip_day_2._1130_cloud

Similar to vip_day_2._1130_cloud (20)

vip_day_2._1130_cloud