.conf Go 2023 presentation: "Many roads lead to Rome - this was our journey" Speakers: Bruno Domingos (Julius Bär) Stefan Meier (Julius Bär)

1. © 2023 SPLUNK INC.
Bruno Domingos Stefan Meier
Bank Julius Bär
Bank Julius Bär

2. Many roads lead to Rome - this was our journey
Splunk .conf Go Zurich
Oct 2023

3. © 2023 SPLUNK INC.
Who are we?
Our organization and our your presenters
AGENDA
Where our journey has started
Why we started using Splunk
What we have seen along the way
Challenges and opportunities we faced by growing with Splunk in the past 10+ years
Where we are heading and key takeaways
Next steps in the foreseeable future
Splunk .conf Go Zurich 2023 - Many roads lead to Rome - this was our journey 3

4. © 2023 SPLUNK INC.
Who are we?
Introducing the speakers and the company
Bruno Martins Domingos
> Lead Engineer Splunk [Information Technology]
> Experienced in working with demanding customers
> With the company for 4 years
The Company
Julius Baer
> Engaged in private banking since 1890
> Shares listed on the SIX Swiss Exchange and included in Swiss Leader
Index (SLI)
> Present in more than 25 countries and over 60 locations
> Approx. 7’000 employees
> Approx. 23k assets to protect (clients, server, network devices & more)
> Hybrid IT setup: on-premises and cloud
Julius Baer is the leading Swiss wealth management group with assets under
management of CHF 441 billion (June 2023).
Splunk .conf Go Zurich 2023 - Many roads lead to Rome - this was our journey 4
Your Speakers
Stefan Meier
> Head of Cyber Fusion Center [Information Security]
> One of the most demanding customers
> With the company for 9 years

5. © 2023 SPLUNK INC.
Our road
Some high-level milestones along the way
2016 2018
2014
• Project:
Centralised
Logging
2012 2020 2023
• Phantom / SOAR
Growth in figures
▪ Started with 20 GB license in 2012, today we are on a 6 TB
license and 1,5PB of searchable data
▪ Started with 3 indexers and 1 search head. Today’s
infrastructure is ongoing a lifecycle and will result in 140
indexers and 20 search heads.
▪ 32 applications and 600 systems where logging to Splunk
in 2014. Currently over 250 applications and 20000
systems send their logs to Splunk
▪ ES, UBA and ITSI looked at but never used in production
▪ Splunk Enterprise & SOAR heavily used
Splunk .conf Go Zurich 2023 - Many roads lead to Rome - this was our journey 5
• Large Infrastructure
Redesign
• ITSI Pilot
• ES Pilot
• Continuous Assurance
Reporting Framework
• Baseline Compliance
Operationalization
• Vulnerability Mgmt
Operationalization
• SIEM Light
• SIEM
• IOC
Management
• Profiling/ML
Support for
SIEM
• Forensics
Readiness
• SOC
Readiness
• CMDB & more
Integration
• ES Re-
validated
• UBA Concept
• Security
Essentials for
Threat Mgmt
• Hunting with
Splunk
• Alerting
readiness
• Indexer
Cluster
• Search Head
Cluster
2021
• Smart Store
• Automation for
configuration deployment

6. © 2023 SPLUNK INC.
Splunk .conf Go Zurich 2023 - Many roads lead to Rome - this was our journey 6
Splunk as a technology was available, but no clear guidelines as to what logs had to be onboarded yet
Drivers
What got us started
Initial Use-Cases
Where we saw the need
Collect and store log data centrally
Protect log data from being overwritten/deleted/unauthorized access
Powerful log analysis & correlation capability for quicker troubleshooting
Focus on application logs rather than infrastructure logs
> E-Forensics: access to application log data in case of legal cases, fill gaps in existing e-discovery solution
> Security Operations Center: monitor data from web proxy, mail gateway, firewall and antivirus solution for malware in
dedicated dashboards, first attempts to correlate events based on hostnames
> IT Operations: to improve troubleshooting capabilities, not used extensively yet
Where our journey has started
The years 2012-2014
… kickstarted the SOC which would become the largest internal customer in BJB

7. © 2023 SPLUNK INC.
What we have seen along the way
2014 - 2023
Splunk Enterprise Security
Splunk Enterprise SIEM
High Availability and
Disaster Recovery
User Behaviour Analytics
Phantom / SOAR
Performance
Management
Continuous Assurance
Reporting
Powerful framework we would have loved to have in place when we started. You have to have your homework done though, starting
from performance management to CIM compliance and its data models related.
We chose to build our own SIEM about 8 years ago which is still in place today. This approach allowed for maximum flexibility at the cost
of higher engineering and maintenance effort. Visibility / use-case coverage and functionality was rated state-of-the-art by penetration
testers, red teams and regulators.
Very early on the Indexer infrastructure was setup in a multi site clustered environment to assure continuous data availability. Once the
overall usage and requirement justified it, also Search Head clusters were setup in CH in 2018 and APAC in 2020.
Interesting approach but we wanted to have a more light-weight solution in place. Thus we created a “UBA light” which was reduced to the
minimum and tuned to our individual setup in the bank. The key focus was on lateral movement and privileged access management.
Phantom (Splunk SOAR) replaced and enhanced large chunks of our existing, proprietary incident response capabilities. A considerable
investment from our end resulted in a few key achievements: faster incident response, standardized case handling & documentation and
vendor-supported 3rd party interfaces for incident response.
To respond to the continuously growing requirements for handling data volume and a long retention period, occasional increases on
Indexer count were done. SmartStore was adopted to allow to keep all the required data searchable without overwhelming traditional
storage and simultaneously increasing resiliency by detaching the storage from the indexers
A framework based almost entirely on Splunk Enterprise and Lookup Tables that calculates Key Risk Indicators of Julius Baer every day,
for every system along our ISMS. Replaced part of the ICS (internal control system) through automation. Many different KRIs are included,
e.g. in the areas of vulnerability management, hardening, identity & access management, etc..
Milestones and Challenges encountered
Splunk .conf Go Zurich 2023 - Many roads lead to Rome - this was our journey 7

8. © 2023 SPLUNK INC.
Splunk .conf Go Zurich 2023 - Many roads lead to Rome - this was our journey 8
Somewhere in the future
Strategy
Use-Cases
From a SOC perspective:
> Less “make”, more “buy” as a general strategy in the SOC. Although make is the best fit, its also the most expensive
one.
> Buy smarter security products instead of sourcing raw log data and write monitoring patterns ourselves.
From an IT perspective:
> Prepare for a decentralized future for data. Adopt preprocessing solutions and federated searching for data access in
a very diverse data landscape.
> Scale up the infrastructure for the next 5 years of growth.
> Automate repeatable administration tasks, implement configuration version control.
> Vulnerability Management: identify vulnerabilities not taken care of in the regular patch cycle and triage an incident
ticket to the right subject matter expert. Splunk Enterprise and/or SOAR are superior to other technologies in use, thus the
migration.
> Baseline Compliance Management: flag deviations from the baseline and triage an incident ticket to the right
stakeholders in the organization. Process is very similar to vulnerability management.
> Application monitoring: provide greater visibility for service and application teams related to system availability,
application performance and behavior and user history building.
Where we are heading
The years yet to come
… not too far away though

9. © 2023 SPLUNK INC.
Happy to elaborate and engage in discussions during the breaks. Looking forward to meeting you.
Key Takeaways
Well, we have learned much in the past ~10 years. Here is what mattered most:
> The enterprise’s IT Splunk infrastructure provider and the SOC need to be in close contact to ensure a working performance management and growth
planning.
> 10 years of SOC include a few legacy items. Sometimes things blow up and repair is needed. Have a plan B when this happens.
> Quality management remains a big challenge (all sources still logging? all fields still available for extraction after a product upgrade? all sources logging
without delay? …)
Splunk .conf Go Zurich 2023 - Many roads lead to Rome - this was our journey 9

10. © 2023 SPLUNK INC.
Thank you
10
Splunk .conf Go Zurich 2023 - Many roads lead to Rome - this was our journey