Haystax carbon for Insider Threat Management & Continuous Evaluation
•Download as PPTX, PDF•
2 likes•1,017 views
Haystax Technology, Inc. provides next-generation intelligence and analytics solutions that deliver up to the minute situational awareness and actionable intelligence for the public and commercial sectors. Haystax uses a combination of software and human analysis to turn large, disparate and unstructured data volumes into comprehensive and actionable information. In essence, these technologies allow users to find “the needle in the haystack” quickly and reliably.
Recommended
More Related Content
What's hot
What's hot (20)
Viewers also liked
Viewers also liked (20)
Similar to Haystax carbon for Insider Threat Management & Continuous Evaluation
Similar to Haystax carbon for Insider Threat Management & Continuous Evaluation (20)
More from Haystax Technology
More from Haystax Technology (9)
Recently uploaded
Recently uploaded (20)
Haystax carbon for Insider Threat Management & Continuous Evaluation
- 1. Haystax Carbon for Enterprise Threat Management Actionable Intelligence for Decision Makers COMPANY PROPRIETARY INFORMATION
- 2. Haystax Technology offers Advanced analytic solutions that provide real time actionable intelligence for complex, high consequence decisions COMPANY PROPRIETARY INFORMATION 1 About us
- 3. Our heritage is in designing elegant solutions for complex problems not suited for traditional “brute force” analytic approaches We have multiple patents for our predictive models & algorithms DHS used our algorithms for risk based grant allocation Our analytics now drive the largest public safety ecosystem in the nation We developed the protective intelligence methodology used by the Bill & Melinda Gates Foundation COMPANY PROPRIETARY INFORMATION 2
- 5. At the core of our Insider Threat management solution is our innovative, proven & efficient Carbon Risk Rating Platform Designed to leverage existing source data investments Designed to fit into existing investigation processes Includes the high performance Haystax Constellation Analytics Engine Designed to enable a wide range of mission optimized business applications Data can be easily handed off for post processing to other applications Investigative Case Construction 3rd Party Analytic Processors Haystax Carbon Risk Rating Continuous Evaluation Engine Carbon Whole Person Model Risk Dashboard Adjudicative Guideline Mapping Expert Assessments Continuous Data Collection Works with a wide range of data sources/types Background Check Peers & Family $ Financial Records HR Record Public Records Web and Social Media COMPANY PROPRIETARY INFORMATION 4
- 6. Haystax Carbon is based on the understanding that Insider Threat Management is a prioritization problem Carbon Automated Evaluation Rotate from Service Or Exploit COMPANY PROPRIETARY INFORMATION 5 Continuous Data Experts & Guideline Compliance Backgroun d Check Peers & Family $ Collection Carbon Whole Person Model Carbon Prioritization Ranking Escalated Response Spend << Time Spend << $$ Financial Records Public Records HR Record Web and Social Media
- 7. The Carbon Whole Person Model provides a single integrated view of an insider for dynamic trust Outside Work At Work Single Integrated View Public Records Employment Data (Current & History) Vehicle/Property Ownership Bank/Credit Records Criminal Records Family/Peer Comments Time In/Out Access Card Swipes Logins/Logouts Network Use Database/Data Store Access Printer User Telecom/Email Use Patterns of Use Continuous Evaluation Continuous Monitoring COMPANY PROPRIETARY INFORMATION 6
- 8. Adjudicative Guidelines are mathematically modeled into Carbon to ensure policy compliance at all times Clearance-worthy Trustworthy Able to Indicativ e Mapping Risk Influence 13 Guidelines AC-f COMPANY PROPRIETARY INFORMATION 7 Enforces scoring results to compliance guidelines Enables scoring rules to adjust based on policy changes Improves transparency for risk rating results Disqualifying Conditions AC-a AC-b AC-c AC-d AC-e AC-g AC-h AL-a AL-b AL-c . . . Alcohol Consumption Allegiant to the United States Unsusceptible to coercion protect classified information Willing to protect classified Unsusceptible information to inducement
- 9. ‘Qualitative’ expert knowledge augments existing data to align insider behavior to an organization’s specific threats IT Security HUMINT Psych Counterintelligence Medical Criminal Investigators Command Peers Family Subject SF86 $ Financial Records Public Records PAEI Carbon scales experts with algorithms Reflects knowledge of experts in the Carbon Whole Person Model Applies data about the subject to the Carbon Whole Person model Evaluates the model’s knowledge continuously as data or priorities change COMPANY PROPRIETARY INFORMATION 8
- 10. Carbon is designed to make the results easy to understand for a wide range of end users COMPANY PROPRIETARY INFORMATION 9 Risk timeline, Alerts, dashboards, Summary level views and drill downs Compare subject to peer groups and historic changes in risk profile Insider Risk Rating Report Insider Pattern of life Timeline Insider Risk Dashboard
- 11. The Carbon Risk Rating runs on the Haystax Constellation Analytic Platform The Constellation Analytics is optimized for high velocity and high volume data processing COMPANY PROPRIETARY INFORMATION 10 Data feeds Analytic Processors Carbon Model Natural Language Entity Resolution Geo Reasoning Association Analysis Scoring Actionable Intelligence through automated discovery, fusing and linking of information with out-of-the box visualizations Built with Open Source Flexible cloud deployment Built using multiple Haystax patents
- 12. Carbon doesn’t just identify risk, but prioritizes it to enable an optimized Insider Threat management system Dynamic IDAM Escalated Response Rotate from Service Or Exploit Professional Observation / Intervention Non-Professional Observation / Intervention Escalated Review / Additional Data Spend << Time Spend << $$ Few People More People Expensive Data Enterprise Data Basic IT Controls Carbon can be easily integrated into existing Insider Threat Management Systems COMPANY PROPRIETARY INFORMATION 11
- 13. The Carbon Risk Rating Platform can serve a wide range of applications E-Adjudication Automated Periodic Reviews Insider Threat Investigations Continuous Evaluation PTSD Suicide Prevention Workplace Violence COMPANY PROPRIETARY INFORMATION 12
- 14. Carbon is designed to integrate into the overall enterprise security system – Cyber Example Log Management / Searching SIEM Threat Management Insider Threat Secure Cloud Gateway SSL Transfer COMPANY PROPRIETARY INFORMATION 13 Peer Network Peer Network Monitored Network Device Device OTX
- 15. How is Carbon different from traditional Insider Threat detection & management? COMPANY PROPRIETARY INFORMATION 14
- 16. The typical approach is to tackle Insider Threat as a signal to noise problem Traditional rules based systems rely on knowing ‘precisely’ what a target looks like Targ Miss False Alar m et Traditional rules based thresholds or flags will identify the obvious, but miss weak signals Lowering thresholds will dramatically increase false alarms, increase investigation time & cost, negatively impact continuous evaluation How do you strike a balance between false alarm rates & missed detections? COMPANY PROPRIETARY INFORMATION 15
- 17. However, Insider Threat is not a classic signal to noise problem that rules based systems can negotiate well Targ et Miss False Alarms Our current systems rely on self-reporting and tips before an investigation can be launched Data is available to improve early detection, but complex rules based systems will generate high numbers of flags Unlike physical objects, people change so systems need to account for their “pattern of life”, Has financial problem? Has alcohol problem? Has work problems ? Has psychologic al problems? not static rules Approach was designed for manual operation on small, infrequent queries COMPANY PROPRIETARY INFORMATION 16
- 18. The ACES Pilot for the DoD showed that traditional rules based approach are too efficient to be viable for large Data populations + Rules Based Detection Results Alarm s 3,370 reviewed 3,077 total flags identified 2,783 cases created 4 Significant Incident Reports 2 Imminent Threats FALSE POSITIVE RATE >20% At this false alarm rate, the USG would generate over 1,000 cases each day! Developed by psychologists over 15 years ago – the ideas are useful, but it is not a modern software system None of the ACES flags are prioritized or machine readable placing all of the burden on human analysts COMPANY PROPRIETARY INFORMATION 17
- 19. The Target cyber fraud case is an example of the problem of sub-optimal alert prioritization COMPANY PROPRIETARY INFORMATION 18 Headlines make it appear that threat detection worked However, information needs to be actionable & prioritized Systems that generate too many false positives are a nuisance The analytic challenge is to scale the human element to connect-the-dots faster
- 20. Haystax Carbon helps overcome the limitations of existing detection systems for Insider Threat management $ Continuous data collection HUMINT Trustworthy Able to Unsusceptible to coercion Unsusceptible to inducement Indicative Mapping Alcohol Consumption Willing to protect classified information Disqualifying conditions protect classified information AC-a AC-b AC-c AC-d AC-e AC-f AC-g AC-h AL-a AL-b AL-c . . . Allegiant to the United States Risk Influence 13 Guidelines Command Peers Rotate from Service Or Exploit Dynamic IDAM COMPANY PROPRIETARY INFORMATION 19 Carbon Whole Person Bayesian Model Mathematical configuration of adjudicative guidelines Few People Expensive Data Prioritization algorithm optimizes threat management Counterintelligence Medical Criminal Investigators Family Psych Subject IT Security SF86 Financial Records Public Records PAEI Expert judgments integrated into model Escalated Response Spend << Time Spend << $$ More People DoD Data Professional Observation / Intervention Non-Professional Observation / Intervention Escalated Review / Additional Data Basic IT Controls
- 21. Haystax Carbon provides an analytic solution to Insider Threat detection & management that cannot be matched by traditional approaches Bayesian whole person model provides contextual analysis that rules-based systems cannot match for relevant results Model driven data ingest beats or matches brute force ‘big machine’ at a fraction of the cost Prioritization algorithm enables focusing investigative human resources on true high-risk individuals COMPANY PROPRIETARY INFORMATION 20
- 22. Haystax: A new kind of Analytics Company We are mature enough to have proven technologies, but new enough to create cutting edge products and deliver one-of-a kind services to the national security community COMPANY PROPRIETARY INFORMATION 21
- 23. Contact us: info@haystax.com Visit us: www.haystax.com 8251 Greensboro Drive, Suite 1111 McLean, VA 22012 COMPANY PROPRIETARY INFORMATION
Editor's Notes
- Our platform
- Say here, this approach cannot be fixed with more data and you cannot scale by adding people…
- ODNI 2012 Report on Security Clearance Determination – 4.9 total clearance holders.
- ODNI 2012 Report on Security Clearance Determination – 4.9 total clearance holders.
- Our delivery approach is an important aspect of who we are a company.