Incident Response: Security's Special Teams
•Download as PPTX, PDF•
1 like•1,474 views
In football, special teams - the groups that do field goals, kick-offs, etc. - don't spend a ton of time on the field. But they routinely win (or lose) games. For this reason, even though special teams is a part-time job for many of the players, they are nonetheless thoroughly conditioned, trained, briefed, and otherwise prepared for this crucial role. Incident response (IR) teams serve a similar function for enterprise IT organizations. Many team members don't work full-time on IR. Yet when they are needed, the stakes couldn't be higher for the IT department. As such, it is absolutely crucial that the IR team is on top of its game. This webinar will review the factors driving the ascendence of IR as the next crucial discipline for IT in general and the CIO / CSO in particular. It will then highlight the crucial components of an effective IR capability with particular emphasis on what leading organizations are doing to upgrade their IR function. Our featured speakers for this timely webinar will be: -Andrew Jaquith, Chief Technology Officer & SVP Cloud Strategy, SilverSky -Ted Julian, Chief Markting Officer, Co3 Systems
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Viewers also liked
Viewers also liked (20)
Similar to Incident Response: Security's Special Teams
Similar to Incident Response: Security's Special Teams (20)
More from Resilient Systems
More from Resilient Systems (20)
Recently uploaded
Recently uploaded (20)
Incident Response: Security's Special Teams
- 2. Page 2 Introductions: Today’s Speakers • Ted Julian, Chief Marketing Officer, Co3 Systems • Ted is a serial entrepreneur who has launched four companies during his ~20 years in the security / compliance industry. • Andrew Jaquith, Chief Technology Officer & SVP Cloud Strategy, SilverSky • Andy is a thought-leader with ~20 years experience in the security industry. He has helped shape the security industry as an enterpreneur at SilverSky and @stake and as an industry analyst at Forrester Research and Yankee Group.
- 3. Page 3 Agenda • Introductions • IR: The Next Security Discipline • Enhancing Your IR Capability • Technology • People • Process • Final Thoughts / Recommendations • Q&A
- 4. Page 4 Co3 Automates Incident Response PREPARE Improve Organizational Readiness • Assign response team • Describe environment • Simulate events and incidents • Focus on organizational gaps REPORT Document Results and Track Performance • Document incident results • Track historical performance • Demonstrate organizational preparedness • Generate audit/compliance reports ASSESS Quantify Potential Impact, Support Privacy Impact Assessments • Track events • Scope regulatory requirements • See $ exposure • Send notice to team • Generate Impact Assessments MANAGE Easily Generate Detailed Incident Response Plans • Escalate to complete IR plan • Oversee the complete plan • Assign tasks: who/what/when • Notify regulators and clients • Monitor progress to completion
- 5. Page 5 SilverSky simplifies how customers secure information MANAGE email, messaging and collaboration SECURE data with our security software MONITOR networks for intrusions 24x7 Exchange Lync SharePoint Email Security Mobile device management Email DLP Email Encryption Email Archive Email Continuity Log management Vulnerabiity management Brand protection UTM management Event monitoring and response Managed BlackBerry By tirelessly safeguarding our customers’ most important information, SilverSky enables growth-minded leaders to pursue their business ambitions without security worry. SilverSky protects $525 billion in banking and credit union assets. Each month, we analyze 15 billion raw security events and investigate 140,000 alerts.
- 6. Page 6 By Mike Kaplan [Public domain], via Wikimedia Commons Offense
- 7. Page 7 By U.S. Navy photo by Mass Communication Specialist David P. Coleman [Public domain], via Wikimedia Commons Defense
- 8. Page 8 By U.S. Navy photo by Lt. Cmdr. Scott Allen. [Public domain], via Wikimedia Commons Special Teams
- 9. Page 9 Information security has three phases too Prevention Detection Response • Stop malicious threats • Secure endpoints, networks, and servers • Maintain secure and compliant configurations • Identify anomalous behavior • Detect compromises • Discover data leaks & potential breaches • Have a plan • Assess events • Escalate to incidents • Manage • Report
- 10. Page 10 Why Incident Response Matters Compromised asset No damage Budget IDS, AV or other control repels an attack Attacker infects a workstation Attacker “pivots” to gains control over sensitive systems Analogy Damage “Preventative care” “Infection” “Disease” millions 000s 0 0 000s millions Multiple compromised assets Chain of events
- 11. Page 11 Compromises are the new reality SilverSky analyzed security incidents based on data from 861 financial institutions for the second half of 2012 We found: • 1,628 likely and confirmed customer compromises • 441 institutions affected • 51% of our financial customers experienced at least one incident SilverSky blocked 1/3 of incidents Traffic analysis detected the rest Size of institution ($assets) Average # of incidents Small (<$25 million) 3 Mid-sized (<$1 Bm) 4 Large (>$1 Bn) 7 Source: SilverSky 2012 2H Financial Institutions Threat Report. (Base: 861 SilverSky customers)
- 12. Page 12 Guess where most IT security budgets go? By victor vic (all in, tapis) [CC-BY-SA-2.0 (http://creativecommons.org/licenses/by-sa/2.0)], via Wikimedia Commons
- 13. Page 13 Prevention + Detection Dominate Security Spend Segment 2012 revenue Prevention / Detection Products $27B* Prevention / Detection Services $29B* Response Services $6B** Response Products < $1B*** * Gartner ** ABI Research ***Co3 estimate 89% 11%
- 14. Page 14 Public Domain Pictures.net - Eggs In The Grass by Ed Hoskins There is a metaphor for this strategy…
- 15. Page 15 IR Demands Investment “If you are going to invest in one thing - it should be incident response.” GARTNER – JUNE 2013 “You can’t afford ineffective incident response.” FORRESTER – APRIL 2013
- 16. POLL
- 17. Page 17 Is This IR? By ErrantX. [Public domain], via Wikimedia Commons
- 18. Page 18 Is This IR?
- 19. Page 19 The Incident Response Lifecycle PREPARE Improve Organizational Readiness • Assign response team • Describe environment • Simulate events and incidents • Focus on organizational gaps REPORT Document Results and Track Performance • Document incident results • Track historical performance • Demonstrate organizational preparedness • Generate audit/compliance reports ASSESS Quantify Potential Impact, Support Privacy Impact Assessments • Track events • Scope regulatory requirements • Calculate $ exposure • Notify team • Generate Impact Assessments MANAGE Easily Generate Detailed Incident Response Plans • Escalate to complete IR plan • Oversee the complete plan • Assign tasks: who/what/when • Notify regulators and clients • Monitor progress to completion
- 20. Page 20 IR Is More Than Just Forensics Forensics Security Tools Threat Intelligence Partners / Providers Law Enforcement IT / Security Controls Service Providers Law Enforcement Partner Perpetrator(s) Internal Staff Customers Detection Investigation IT / Security Controls Service Providers Law Enforcement Partners Internal Staff Response IR Team
- 21. POLL
- 22. Page 22 • IT • Legal • Compliance • Audit • Privacy • Marketing • HR • Senior Executives INTERNAL • Legal • Consultants • Audit • Law Enforcement • Partners EXTERNAL DON’T FORGET TO: • Communicate • Practice • Train Incident Response People
- 23. Page 23 Incident Response Process PREPARE Improve Organizational Readiness • Assign response team • Describe environment • Simulate events and incidents • Focus on organizational gaps REPORT Document Results and Track Performance • Document incident results • Track historical performance • Demonstrate organizational preparedness • Generate audit/compliance reports ASSESS Quantify Potential Impact, Support Privacy Impact Assessments • Track events • Scope regulatory requirements • Calculate $ exposure • Notify team • Generate Impact Assessments MANAGE Easily Generate Detailed Incident Response Plans • Escalate to complete IR plan • Oversee the complete plan • Assign tasks: who/what/when • Notify regulators and clients • Monitor progress to completion BE SURE TO INCLUDE: • Regulatory Requirements • State, Federal, and Trade • Industry Standard Frameworks • NIST, CERT, SANS • Organization Standards / Best Practices • Contractual Requirements
- 24. Page 24 Incident Response Technology This? By KoS. [Public domain], via Wikimedia Commons
- 25. Page 25 Incident Response Technology This? By Rens ten Hagen. [Public domain], via Wikimedia Commons
- 26. Page 26 Incident Response Technology This?
- 27. Page 27 Incident Response Technology SYSTEM REQS • Secure • Distinct • Available • Integrated with related systems • Prescriptive • Cognizant of regulations, best practices, threats • Easy to use • Built-in workflow • Built-in reporting / dashboards • Always up to date • Linked to threat intelligence • Faster response time • Staff augmentation • Consistency • Repeatability • Ensure compliance • Foster collaboration • Simplify reporting / status updates • Improved threat context / correlation OBJECTIVES FUNCTIONAL REQUIREMENTS
- 28. QUESTIONS
- 29. One Alewife Center, Suite 450 Cambridge, MA 02140 PHONE 617.206.3900 WWW.CO3SYS.COM Andrew Jaquith Chief Technology Officer & SVP Cloud Strategy SilverSky ajaquith@silversky.com www.silversky.com “One of the most important startups in security…” BUSINESS INSIDER – JANUARY 2013 “One of the hottest products at RSA…” NETWORK WORLD – FEBRUARY 2013 “an invaluable weapon when responding to security incidents.” GOVERNMENT COMPUTER NEWS “Co3 Systems makes the process of planning for a nightmare scenario as painless as possible, making it an Editors’ Choice.” PC MAGAZINE, EDITOR’S CHOICE
Editor's Notes
- http://en.wikipedia.org/wiki/File:Shea_Smith-edit1.jpgThis image or file is a work of a U.S. Air Force Airman or employee, taken or made during the course of the person's official duties. As a work of the U.S. federal government, the image or file is in the public domain.
- http://en.wikipedia.org/wiki/File:2006_Pro_Bowl_tackle.jpgThis image is in the public domain because it contains materials that originally came from the United States Marine Corps. As a work of the U.S. federal government, the image is in the public domain.
- http://en.wikipedia.org/wiki/File:Shane_Lechler_punts_at_Falcons_at_Raiders_11-2-08.JPGPhoto taken by User:BrokenSphere and released under the following license(s). You may use it for any purpose as long as you credit me and follow the terms of the license you choose.Example: © BrokenSphere / Wikimedia Commons
- Preventative: $7115. Detect/respond: $1040