This document discusses Travis Perkins' transition from a legacy security operations center (SOC) to a lean SOC using Splunk software. It describes the challenges of Travis Perkins' complex IT environment and their goal of building security solutions for the cloud. The document outlines Travis Perkins' process for incrementally implementing their SOC using Splunk and focusing on incident handling, investigations, and compliance. It provides examples of how Travis Perkins uses risk-based alerting, incident response workflows, and analytics in Splunk to analyze security events.

1. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Building a ‘Lean SOC’ Over
‘Legacy SOC’ at Travis Perkins
Matthias Maier | Product Marketing Director, Splunk
Nick Bleech | Head of Information Security, Travis Perkins

2. © 2018 SPLUNK INC.
Splunk Company Overview
Global HQs
San Francisco
London
Hong Kong
4,000+
Employees Globally
NASDAQ:
SPLK
Annual Revenue
$1.25B+
89 of the Fortune 100
Rely on Splunk
Across
110+
Countries
Customers Range From
Small Businesses to
Large Organizations
Largest License:
4+Petabytes/day
16,000+
Customers
Splunk4Good
$100 Million Commitment
to Support Nonprofits,
Research & Education

3. © 2017 SPLUNK INC.
© 2018 SPLUNK INC.
OUR MISSION

4. Cloud
Security
Endpoints
Orchestration
WAF & App
Security
Threat Intelligence
Network
Web Proxy
Firewall
Identity and Access

5. © 2017 SPLUNK INC.
Collaborative SOC
Solve across multiple domains
Establish security operations
Specific problem
Nerve center for security

6. © 2018 SPLUNK INC.
Power a
Collaborative
SOC AUTOMATION AND
ORCHESTRATION
INTERCONNECTED
SECURITY STACK
MACHINE LEARNING TO
AUGMENT HUMAN SKILLS
ADAPTIVE RESPONSE
Collaborative SOC
multiple domains
blish security operations
fic problem
Nerve center for security

7. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Building a ‘Lean SOC’ Over
‘Legacy SOC’ at Travis Perkins
Nick Bleech | Head of Information Security, Travis Perkins

8. © 2018 SPLUNK INC.
Nick Bleech and Travis Perkins Group
• I’m currently the Head of Information Security for the Travis
Perkins Group, the UK’s largest building materials
merchants
• Before Travis Perkins I was CISO at Rolls-Royce plc.
o Served on the board of the Jericho Forum
o Expert group which established core principles for Cloud
Computing
• My team at Travis Perkins Group tackles practical
challenges including:
o Security monitoring
o Incident response
o Data security
o Driving governance to tackle Cloud Computing

9. © 2018 SPLUNK INC.
Challenges – Travis Perkins Group
• Complex IT - a mix of on-premise legacy systems /
services and the cloud services progressively replacing
them
• ‘Cloud First’ - all new solutions must deploy into Cloud
and work with on-premise as needed
• SIEM business drivers balanced between incidents,
investigations and compliance use cases – need flexible
and adaptable technology

10. © 2018 SPLUNK INC.
The beginning
• The ‘Big Bang’:
o Acquire SIEM hardware & software – one size fits all – ($$$$)
o Connect as many sources as possible (Look Ma – all those connectors!)
o No data source is too large or too complex – let’s not think too hard
o This cloud thing’s coming – we’ll cross that bridge when we get there
• When budget /time /resources run out:
SIEM ‘mark one’ that was tagged ‘never again’
Oh dear...stop!

11. © 2018 SPLUNK INC.
Critical Success factors for SIEM ‘mark two’
• Plan/Deliver incrementally – no ‘big bang’
• Hybrid – both cloud and on prem
• ‘Lean’ SOC: Grow just enough SIEM architecture
and SOC capability for required use-cases
• Focus incident handling for maximum effectiveness
• Don’t forget investigation / compliance use cases
• Many potential data sources; both ‘agent-based’ &
‘agentless’ collection
• Understand the characteristics of each data source
• Acknowledge and meet multiple use-case and
Enterprise Security Architectural needs
SIEMData
Sources
Investment
Case
Sourcing
Strategy
Enterprise Security
Arch
SIEM
Arch
Use
Cases

12. © 2018 SPLUNK INC.
Organizational Incident Handling Process
• Fire drills to test the incident
response process
• Exec wanted every 15m
updates
• How fast do you get
questions out of the incident
response process from the
IT team?
• It comes down to tools and
technologies the team
utilizes

13. © 2018 SPLUNK INC.
Risk (Threat) Score Based Incident Alerting
• An alert can be like a finger on a spray can: a little alert can trigger a lot
of response if you put the right stuff in the can
Extra Benefit:
• Tunable – false positives - we’ve only had to adjust once so far
Use intrinsic Splunk / ES risk scoring appropriately
Asset / Identity Risk Score
HR-Server01 1.000
• FireEye Alert +500
• Anti Virus Alert +100
• SIEM Anomaly + 500
• …

14. © 2018 SPLUNK INC.
Incident Response Model
Canned responses are
80% effective in the first
instance and always
provide some value by
gathering additional
information

15. © 2018 SPLUNK INC.
Lean SOC Incident Process
Risk score
triggers alert for
target
OPs team
responds,
gathers info,
claims notable
events &
updates them
with info
OPs team creates
incidents for
automated in-
depth malware
scans an/or
automated
forensics,
updates events
OPs team
submits any
binary samples
from target to
enterprise AV
vendor,
requests AC
scan & cleanup
Infosec confirm
using Splunk &
data collected
by Ops that
target is clean.
If target is not
clean, IS can
request rebuild
or access to
target for more
forensics

16. © 2018 SPLUNK INC.
Splunk Incident Analysis

17. © 2018 SPLUNK INC.
Splunk Incident Analysis: Contributing Events

18. © 2018 SPLUNK INC.
SOC / SIEM Initial Build
• We ran an on-prem pilot / proof of value using “found” hardware
o Bore an uncanny resemblance to hardware from our previous SIEM…
• We got a working solution, but speed, storage, and reliability issues arose
• Analysts not good SysAdmins – so get better not minding infrastructure
• Per our Cloud First strategy, we considered Splunk Cloud or host it on our own:
o In terms of cost/benefit, Splunk Cloud option came out ahead
• Migration took 2 days to get basic functionality up and running

19. © 2018 SPLUNK INC.
SOC / SIEM Evolution 2015-2018
The Evolution decisions we considered / are considering
6,391.49
• Adaptive Response / SOAR
• Behaviour Analytics / Machine Learning
• Threat Hunting
• Threat Intel services

20. © 2018 SPLUNK INC.
Benefits Obtained and Future Roadmap
• 1-2 days from ingesting new data to deliver meaningful reports/dashboards
• Splunk CloudOps take pain out of managing host infrastructure
• Intrinsic risk-scoring correlation in Splunk/ES focuses us on known-knowns
• Architecture has proven to be robust; platform is reliable. 5-40+ sources
• Splunk intrinsic Analytics & Machine Learning: 'Are we missing anything?'
'What's the impact?’ Our data science journey has just begun
• We have future growth path should use cases and/or architecture so require

21. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Thank You