The current network monitoring model is challenged by advanced attacks over long periods of time, complex threats, and too many point products for analysts to process. On average, enterprise breaches are detected over 200 days later. ProtectWise offers a new utility model for security that delivers pervasive visibility through cloud-based automated threat detection and unlimited forensic exploration. It uses network traffic analysis, machine learning, heuristics, signatures, and retrospective and predictive analytics across 24 hours to 1 year of data with collective correlation to function as a "time machine" for threat detection. ProtectWise uses Cassandra and Search from DataStax for its large distributed system needs. Security should be provided like basic utilities through deep automation across many surfaces in the cloud

1. How Virtual Reality & Machine Learning Are Powering
The New Age of Network Monitoring
DataStax Data & Drinks Denver
April 25, 2017

2. THE CURRENT MODEL IS CHALLENGED
Advanced Attacks
Complex threats execute over
long periods of time.
Point Product Chaos
Point products overwhelm the
human ability to process.
Resource Shortage
Not enough humans to
manage a response, let alone
hunt for threats.
Average enterprise breach
detection window is over 200
days
On prem and siloed point
products weigh down security
architecture
Less than 10% of an analyst’s
time is spent in proactive
analysis

3. THE PROTECTWISE GRID
3
A new utility model for enterprise security,
delivering pervasive visibility, automated threat
detection and unlimited forensic exploration —
on-demand and entirely from the cloud.
“Never, in 52 years in this field, have I seen a
collection of dashboards that even comes close
to the collection you'll see in ProtectWise.”
Peter Stephenson, Editor at Large SC Magazine

4. 4
Network Traffic
Behavioral Analysis
Machine Learning
Heuristics
Signatures
24 hours
1 month
6 month
1 year
RETROSPECTIVE
ANALYTICS
+6 months
+1 month
+24 hours
PREDICTIVE
ANALYSIS
REAL TIME ANALYTICS
C1 C2 C3
COLLECTIVE CORRELATION
A TIME MACHINE FOR THREAT DETECTION

5. 5
PROTECTWISE AND DATASTAX

6. 6
WHY DATASTAX
● Needed Cassandra and Search combined
● Large distributed systems are hard
● Synchronizing them is crazy hard
● Access to support was crucial
● Time to market was imperative
● They are good people

7. COVERAGE MODEL
What’s missing from big data is data

8. BIG DATA
- Log Files
- Metadata
- Threat Intelligence
- Context
…all of these are not
enough

9. 9
EPIC DATA
IoT
Industrial
Controls
Virtual
Environments
Firewalls
Log Files
Threat Intel
PCAP
Metadata
Endpoint

10. Intelligent data reasoning based on first principles
DATA ANALYSIS

11. SECURITY FROM FIRST PRINCIPLES
Comprehensive Contextual Correlated
Full packet capture across
traditional, virtual (cloud),
industrial control, IoT
Cross-reference of
multiple indicators
included in analysis
Numerous classifiers and
statistical analysis
modeled to form a
consensus of experts
Consensus
Pattern recognition to
detect security events
from a plethora of
observations

12. Security at scale
THE UTILITY OF THE CLOUD

13. Security should be …
● A fundamentally basic service
● Continuous and unbroken
● Provided like other basic utilities
(e.g. electricity and water)
● An operations expense
● Deeply automated
● Accessed via a myriad of surfaces
A technology truly matures when it disappears
and becomes beautiful
A Utility

14. IMMERSIVE SECURITY

15. 15
To fundamentally change human experience
in security

16. THANK YOU