SIEM Alone is Not Enough

4,449 views

Published on

This presentation addresses:
-True shortcomings of traditional SIEM solutions
-Why security controls that are utilized in isolation are limited in providing useful indicators of data breaches
-How an alternative approach to IT security that combines state data from multiple security controls provides more advanced incident detection, adds a layer of risk context, and provides more intelligent security for protecting your data

Published in: Technology, Business
0 Comments
3 Likes
Statistics
Notes
  • Be the first to comment

No Downloads
Views
Total views
4,449
On SlideShare
0
From Embeds
0
Number of Embeds
1,437
Actions
Shares
0
Downloads
85
Comments
0
Likes
3
Embeds 0
No embeds

No notes for slide
  • Use under detective or investigate and correctOnce you know you’ve been breached, you want to know what changed, what happened, am I still in the reliable state. Bridge between detective and corrective. Set up to the corrective piece. Correction flows from Time is your enemy – need to manage in weeks and hours, not months or years. Need to know your answer to these questionsNeed to have things in place that need to be corrective
  • Moving these slide up – and combining it with secure configuration.Also with audit logging (set it up earlier with 87% of the DBIR)Do these with automationAnd add correlation and intelligent-- One point is a point, two is a line, three is a trends
  • Event Integration Framework benefits:Aggregate change data based on criticalityCan integrate a single criticality level into a single log messageEIF reports “who” made the changeReports on patterns of compliance (change reduces compliance level of a box then report it – not just in or out of a compliant state)
  • Things you witness (TLC)Things not expected (TE)
  • Part of detection, combine with log data stats. All the data is there, but you can’t do it manually. Detective controls need to be automated.
  • Tripwire VIA delivers an integrated IT security framework to proactively and continuously protect critical data and infrastructure. The VIA platform offers components that build on your integrated controls to:Provide proprietary security and policy content to protect against the most common attacks.Let you manage monitored assets more intuitively and in business context.Let you use data from the various controls for analytics and reporting in Tripwire and third party tools.Combine security controls through automated workflows that address key IT security needs.The Tripwire VIA platform:Provides you with business-aligned leading indicators of riskCombines protective security controls that harden systems against compromise and detective security controls that continuously monitor systems for threats, risks and non-compliance. Integrates data from both protective and detective controls that adds a layer of contextual intelligence to detect incident that may cause undesired risk to the organization.Continuously monitors for system integrity, unauthorized changes, security vulnerabilities and incidents and non-compliance across the virtual, physical and cloud infrastructure to ensure security defenses are maintainedEnsures organizations that their critical security controls provide continuous protection, mitigate the risks of cyber threats and delivers business context across assets, business services, policies, data types and risks.ContentIntegrated content for security hardening and continuous monitoring to protect your critical data and mitigate risks. Leading enterprise organizations rely on this content to automatically identify and fix weaknesses in their cyber defenses and detect when someone has tampered with systems.ContextThe Tripwire VIA platform is designed to turn the massive amounts of data your critical security controls produce into information you can use to protect your data and infrastructure. It also lets you add business context to your monitored assets. Tripwire VIA identifies and alerts on suspicious and unexpected events and places them in context of your assets, business services and risk profiles.AnalyticsEasily use data from controls in dashboards and a variety of analysis and reporting tools, add it to data marts, and correlate data from multiple controls to identify security threats, trends and status.WorkflowThe Tripwire VIA platform delivers built-in workflows so you can quickly implement and integrate your critical security controls in ways that turn the data they provide into information that helps you improve security.
  • ×