At the 2018 CRIAQ RDV Forum, Interset Director of Field Operations Jay Lillie presented on Interset's mission to apply principled math and data science to cybersecurity in order to detect insider threats.

1. Innovating in
Cybersecurity
Jay Lillie
Director of Field Operations

2. Traditional cybersecurity
Match the pattern…
…detect the threat.

3. The practice includes…
 Rules and thresholds
 Training algorithms with data
Ideal for finding malware
 Decades of data to study
 Always looks the same no
matter where it manifests
Traditional cybersecurity

4. The practice includes…
 Rules and thresholds
 Training algorithms with data
Ideal for finding malware
 Decades of data to study
 Always looks the same no
matter where it manifests
Traditional cybersecurity
“Tell me what I’m looking for…”

5. Traditional cybersecurity
You only find exactly what you’re
seeking… nothing more.
 Working at midnight?
 Attaching 500MB to an email?
 Looking at corporate strategy data?
 Checking out software code from Project X?
 A machine communicating on port 465?
 Machine A & B connecting via HTTP?
 Printer “P015” printing 50 pages at noon?
 cmd.exe launched on a workstation?
Which of these represent a
malicious actor on your network
attempting to steal data?
This makes the approach
ineffective for detecting
insider threats because the
appropriateness of the
behavior is based on
context.

6. Traditional cybersecurity
You only find exactly what you’re
seeking… nothing more.
 Working at midnight?
 Attaching 500MB to an email?
 Looking at corporate strategy data?
 Checking out software code from Project X?
 A machine communicating on port 465?
 Machine A & B connecting via HTTP?
 Printer “P015” printing 50 pages at noon?
 cmd.exe launched on a workstation?
Q: Which of these actions
are a sign of a malicious
insider?
A: It depends.

7. Traditional cybersecurity
You only find exactly what you’re
seeking… nothing more.
Without context for reference
when assessing insider actions,
you’re “flying blind.”
You can’t fight what you don’t see…

8. 8 | © 2018 Interset Software8 | © 2018 Interset Software8 | © 2018 Interset Software8 | © 2018 Interset Software
Hey. I’m Stephan Jou. I like analytics.
CTO at Interset
 Previously: Cognos and IBM’s Business Analytics
CTO Office
 Big data analytics, visualization, cloud, predictive
analytics, data mining, neural networks, mobile,
dash-boarding and semantic search
 M.Sc. in Computational Neuroscience and
Biomedical Engineering, and a dual B.Sc. in
Computer Science and Human Physiology, all
from the University of Toronto

9. Rather than a cybersecurity company trying to learn to properly
apply analytical principles…
is an analytics company
applying principled math and data science
to the cybersecurity domain.
Our fundamental innovation premise

10. Rather than trying to define the nearly infinite
ways that “bad” (abnormal) behavior can
manifest itself….
…observe the “good” (normal) behavior and
focus on the small set of actions that deviate.
The idea

11. This produces an approach that is uniquely
suited for detection of insider threats and
external exploits with insider characteristics.

12. | © 2018 Interset Software12 | © 2018 Interset Software
Behavioral analytics based on principled anomaly detection
Observe what is normal (expected)…
… for a user
… for a server
… for a printer
… for a website
… for network traffic
… for a workstation
And identify actions that are abnormal (low probability)…
… for the entity
… its peers
… and the population

13. | © 2018 Interset Software13 | © 2018 Interset Software
Behavioral analytics based on principled anomaly detection
Observe what is normal…
… for a user
… for a server
… for a printer
… for a website
… for network traffic
… for a workstation
And build a case around relevant {(“Hey, you should look at this!!!”)} abnormalities…
… for the entity
… its peers
… and the population

14. | © 2018 Interset Software14 | © 2018 Interset Software
Behavioral analytics based on principled anomaly detection
Built a platform that…
… is analyst-friendly
… integrates itself within existing ecosystems
… can handle billions of events across hundreds of
thousands of entities
… to produce a handful of actionable threat leads

15. 15 | © 2018 Interset Software15 | © 2018 Interset Software15 | © 2018 Interset Software15 | © 2018 Interset Software
How do we stay innovative?
SECURITY ANALYTICS LEADER PARTNERSABOUT US
Data science & analytics
focused on cybersecurity
100 person-years of security
analytics and anomaly
detection R&D
Offices in Ottawa, Canada;
Newport Beach, CA
Interset.AI
Nothing beats continuous,
focused effort.
Being in a hot market
space helps.
PROUDLY Canadian!

16. 16 | © 2018 Interset Software16 | © 2018 Interset Software16 | © 2018 Interset Software16 | © 2018 Interset Software
But people matter most (*hint* …market awareness helps us find good people!)

17. 17 | © 2018 Interset Software17 | © 2018 Interset Software17 | © 2018 Interset Software17 | © 2018 Interset Software
We would like to thank…
 Being ahead of the market
requires “early adopter”
customers to believe in our
vision
 Constant feedback and
communications make us
better
 Machine learning in
cybersecurity is now taken for
granted
 Their “security approach” to
analytics instead of an
“analytical approach” to
security keeps us far ahead
 Every new story is an
opportunity to test and refine
our approach
 Customers become smarter
and more discerning
 Real threat concerns become
common touchpoints
Our customers Our competitors News headlines

18. 18 | © 2018 Interset Software18 | © 2018 Interset Software
18 | © 2018 Interset Software
And, thank you!
Learn more at Interset.AI
Jay Lillie
Director of Field
Operations