Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Can Security and Automation Work Together
Similar to Can Security and Automation Work Together (20)
More from Trish McGinity, CCSK
More from Trish McGinity, CCSK (16)
Recently uploaded
Recently uploaded (20)
Can Security and Automation Work Together
- 1. © 2015 ServiceNow All Rights Reserved Security and Automation: Can they work together? Can we survive if they don’t? Rob Randell, CISSP Director, Security and Risk Solutions Consulting
- 2. © 2016 ServiceNow All Rights Reserved The Problem Reference: http://ir.finjan.com/all-sec-filings/content/0001628280-15-006727/ex992finjanirpresentatio.htm??TB_iframe=true&height=auto&width=auto&preload=false
- 3. © 2016 ServiceNow All Rights Reserved Business Impact: Time to Containment is Key to Reducing Impact and Cost of Breach Source: Ponemon Institute 2016 On average, it took respondents 229 days to spot a breach caused by malicious agents, and 82 days to contain it.
- 4. © 2016 ServiceNow All Rights Reserved Why are Defenses Failing? Disparate and Siloes Security Tools SIEMS, Malware, Threat Network Protection Endpoint Solutions Access & Identity Solutions
- 5. © 2016 ServiceNow All Rights Reserved Security Teams Are Overwhelmed Manual Tools Too Many Alerts & No Context Siloed from IT Security IT
- 6. © 2016 ServiceNow All Rights Reserved Its 1999 Operations Management all over again!!!!! Thousands of events per day… people can’t scale to meet the volume SIEM Firewall/IPS/IDS Identity & Access Threat/Intel Vulnerability Detection Network Security Security Endpoint Detection Security & IT Teams What do we do with all of this?! What do we do with all of this? • Consolidate to a Single System • Understand Business Criticality • Execute Consistent Workflow • Manage Service Levels • Auto Remediate • Capture Metrics • Enable IT, Security, & BU Collaboration • Meet Audit and Regulatory Requirements
- 7. © 2016 ServiceNow All Rights Reserved Security Response Optimization – Time to Identify/Detect Too many systems and tools Too many events / too much information Not enough context Security Analyst Tier 1 Tier 2 Tier 3
- 8. © 2016 ServiceNow All Rights Reserved Security Response Optimization – Time to Contain Lack knowledge for containment and resolution steps Too long to respond Proactive response Security Analyst Multiple Round-trips Poor cross-team response times Response Automation
- 9. © 2016 ServiceNow All Rights Reserved Sample Response Workflow IDS Alert Generates Incident Analyst needs to prioritize, assign and categorize incident Analyst needs to identify and extract IPs, hashes and indicators Analyst needs to run reputational lookups via threat intel on indicators Analyst needs to get network connections off target machine Analyst needs to run hashes on all running processes Analyst needs to run threat intel lookups on all processes and network connections Analyst needs to confirm threat Analyst needs to get running processes off target machine Analyst starts remediation and containment *Note: Blue boxes indicate data enrichment activities
- 10. © 2016 ServiceNow All Rights Reserved Enterprise Security Response The Need: Enterprise Security Response! Security Incident Response Vulnerability Response Threat Intelligence Workflow & Automation Deep IT Integration
- 11. © 2016 ServiceNow All Rights Reserved Getting started with automation Objectives – Automation, how and where to begin What you will learn – Some of the definition(s) of Automation – Learn about automating Enterprise Security Response – Crawl, walk, run
- 12. © 2016 ServiceNow All Rights Reserved One in ~32 million definitions
- 13. © 2016 ServiceNow All Rights Reserved Automation vs Orchestration: What’s the Difference? • Orchestration vs. automation – a lot of people use the terms interchangeably • Automation – Execution of a simple task or action by a machine • Orchestration – Optimization and automated execution of an end-to-end workflow or complex series of processes, tasks and actions Orchestration Automation
- 14. © 2016 ServiceNow All Rights Reserved Is it risky? “Automate and/or die” – Anton Chuvakin Yes! But you are probably doing it today
- 15. © 2016 ServiceNow All Rights Reserved Most widely known automation • The most common automation story is quarantining an infected system • The auto-blocking tools vendors warn that if you don’t automate you will make the cover of the NY Times • Most folks remember the heydays when IPS was taking down production business applications every Friday at beer o’clock – That of course is when the IPS appliance CPU wasn’t at 100% • Many of these were poorly designed automation tools built with the of best intentions
- 16. © 2016 ServiceNow All Rights Reserved Crawl, walk, run, robot
- 17. © 2016 ServiceNow All Rights Reserved Security Operations Maturity Levels 1 – Basic Operations Security Operations Maturity 2 – Visibility and Performance 3 - Context and Enrichment 4 - Automated Remediation Value-based Prioritization, Visibility and Reporting Enhanced data enrichment tied to incidents Context-driven detection Automated Response Actions for Proactive Measures and Countermeasures Integrated Change Request and History Circles of Trust for Peer Intel Sharing Dynamic Workflow to Educate and Enable SOC Teams Basic Incident Ticketing, Incident Response Definition Prioritization by Impact KPIs, Reporting and SLAs Noise Reduction Automate data gathering tasks Threat intelligence integrated with IR Time to Detect per event reduced Compress the time to contain and remediate incidents Enable visibility for changes and task fulfillment across teams Easily handle common attacks to improve response closure Integration with core security systems Process and Accountability Defined Security Information Network for intel and attack method updates Automated querying of internal and supplier environments Educational expert systems and best practice sharing EnhancedTimetoDetectandRespond 5 – Networked Intelligence A large percentage of organizations are working at Level 1
- 18. © 2016 ServiceNow All Rights Reserved Sooooo….What can you automate? (without getting fired*) * if you are fired for doing everything I outline here you have my sympathy but I surely am not to blame • Start with something simple, repetitive, important - and something that is going to save your analysts’ time • A typical phishing investigation can take about 20-30 minutes and requires a lot of manual steps – When not followed up on it can lead to large costs and infection – When following up you may miss other pressing issues – Initial (triage) research does not require a particular set of skills
- 19. © 2016 ServiceNow All Rights Reserved Start passively • Automate process lookups – What is running? • Is this normal? – What is open? • Explode malware in sandbox • Pull asset records – Who owns it? – Where is it? • Threat lookups – Have I seen this before? – Has someone else seen it?
- 20. © 2016 ServiceNow All Rights Reserved Grow to human stopgaps • Disable account – Only when confirmed to be compromised • Block on firewall – Only block known infected systems • Reset passwords • Delete phishing email(s) • Push button automation
- 21. © 2016 ServiceNow All Rights Reserved Go Active • Move to active after significant testing • Blocking – Can be disruptive but can also be undone quickly • Disabling accounts – Can keep you out of the headlines • Audit everything! – Create Change records for every automated task • Do more with the same! – Automation allows your analysts to operate at lightspeed
- 22. © 2016 ServiceNow All Rights Reserved
- 23. © 2016 ServiceNow All Rights Reserved 1 2 3 Top Takeaways Start passively Grow to gated automation Move to active (albeit carefully)
- 24. © 2016 ServiceNow All Rights Reserved What’s the Ideal Response Process? 1 6 3 4 5 UTILIZE THREAT INTELLIGENCE INTEGRATE YOUR SECURITY PRODUCTS DETERMINE RESPONSE ACTION REMEDIATE THREATS FAST REVIEW POST INCIDENT REPORTS 2 AUTOMATICALLY PRIORITIZE SECURITY INCIDENTS
- 25. © 2015 ServiceNow All Rights Reserved 25 Thank you! Director Solutions Consulting - Security ServiceNow Rob Randell
Editor's Notes
- <click> Well first, while all of an organization’s security products do a nice job of protecting and detection potential security incidents, they create A LOT of alerts. Some organizations can see hundreds or even thousands of these alerts a day. How do they tell them apart? Which ones do they work on first? The graphic on the screen is an interesting way of visualizing it. All of those alerts look pretty similar. Is the red one most important? Or the darker red or red outline? The alerts are typically missing context or how or if a particular alert will really affect an organization. <click> Then – once a security teams knows they have a problem, the tools they are using for resolution are typically manual. For example, many organizations take the alerts from their systems – whether they are directly from an endpoint security product, firewall or even a SIEM and put them into the best data repository they have – a spreadsheet or Microsoft Excel. And as they work on the process for resolving the problem, the processes are might be on paper as part of a policy or they need to go and speak with another security analyst or team member. And do they teams communicate? Via the same tools they use for other communications – email. <click> And lastly, we are finding that while security and IT teams are all part of the same larger group, they typically act in silos. They use different toolsets. These silos and toolsets are another important factor as when security teams determine what’s needed to fix a problem, it is typically IT that is required to fix the problem. This could be patching or rebooting a server. Or taking a machine off of the network. Or disabling a person’s network or AD credentials. These silos cause resolution to take longer.
- “Drinking from the firehose”
- So, what this demo is going to highlight is some of the investments that we’ve been making in security operations for Istanbul. It highlights integrations with strategic security vendors, automation of data enrichment to help answer those questions that the security analyst needs to ask, and orchestration and remediation. It’s also a bit rough as we’re still putting the final touches on things, but what I’m going to demo is an integration with Palo Alto Networks, where we receive an alert from their WildFire malware system and we use that information to automatically run reputational lookups to get more information and from there we initiate an orchestration task to block a malicious network site on the Palo Alto Networks firewall. Normally, the enrichment process would take a significant amount of time and the ability to get a change put quickly in place, but what we’re ultimately demonstrating is a compression of the time to identify and time to contain windows.
- Note: Highlight why the audience should care to sit through your presentation. For example, if you want to automate your legacy processes, you’ll learn what we did and how we accomplished it. Our experience with compliance/QA challenges can save your company time and headaches.
- For me automation could be many things; route a some work, do a lookup, install a patch, block a computer, disable an account, all of the above! Explain the SN instance provisioning process What is automation? It isn’t the same for everyone. Hell, it isn’t even the same across a single business Legacy systems have little to none available Private and Public Clouds may have a fair bit of it
- Flip baby image around
- 17
- Note: Please limit to one slide.
- The step-by-step journey diagram from the corporate marketing message