Downloaded 16 times
Uploaded byFidelis Cybersecurity
Insider Threats Part 2: Preventing Data Exfiltration with Fidelis Elevate
The document focuses on preventing data exfiltration through insider threats, defining categories and indicators of risk, and introducing methodologies for assessing and mitigating such threats. It highlights the importance of establishing behavioral baselines and discusses the role of metadata in enhancing security measures. Additionally, it showcases the Fidelis architecture and emphasizes a proactive approach in monitoring and managing insider threats.
More Related Content
Similar to Insider Threats Part 2: Preventing Data Exfiltration with Fidelis Elevate
Insider Threats Part 2: Preventing Data Exfiltration with Fidelis Elevate
- 1. Insider Threat PartII Preventing Data Exfiltration
- 2. © Fidelis Cybersecurity Intro 2 LucasChumley Senior Sales Engineer Louis Smith Director, Sales Engineering
- 3. © Fidelis Cybersecurity InsiderThreat Session I Round Up Defining an Insider Threat: • Categories of Insider Threat • Cross functional responsibilities • Indicators of Elevated Risk • The Struggle is Real • Assessing your Insider Threat Preparedness • Demo: Mitigate & Detect an Insider Threat 3
- 4. © Fidelis Cybersecurity Flavorsof Data Exfiltration Digital IP, M&A Activity, Accounting Records, Customer Data 4 Physical Excessive printing, USB thumb drive control, physically moving media from one place to another, etc. Biggest Data Breaches of 21st Century Equifax: Over 145 million people were affected by the data breach which saw social security numbers, birth dates, home addresses and in some cases, drivers license numbers stolen www.csoonline.com
- 5. © Fidelis Cybersecurity InsiderThreat – The Risk 5
- 6. © Fidelis Cybersecurity C2Malware Anomaly 6 A malware anomaly may have been caused via a successful phishing attack that has resulted in an infected asset. Many hacking groups design malware with the sole purpose of exfiltrating data.
- 7. © Fidelis Cybersecurity Establishinga Baseline What’s normal? What’s not normal? 1) What is a baseline? 2) Examples of baselines vs. anomalous behavior 3) How Fidelis can help you establish a baseline 7
- 8. © Fidelis Cybersecurity TheFidelis Architecture 8
- 9. © Fidelis Cybersecurity FidelisSecret Sauce 1. Metadata Helps the risk of : IoT devices, Cloud, Endpoint, File Servers, Network activity and Active Directory. Metadata also allows companies to Threat Hunt across their organization by way of reassembled Deep Session Inspection. 2. Minimize Dwell Time + Understanding Flavors of Data Exfil + Understanding the Types of Insider Threats + Establishing a Baseline = Reduced Dwell Time within your Organization 9
- 10. © Fidelis Cybersecurity TraditionalApproach and Methodology 10 Monitor all behavior, all the time Detect and alert on baseline anomalies or divergence Investigate Alerts
- 11. © Fidelis Cybersecurity TheFidelis Difference 11 Monitor and apply automatic analysis to all behavior, all the time. Integrate prevention, detection, investigation and remediation tools to allow for simultaneous operations. Automated detection, identification and classification of key assets and their alerts to minimize both dwell time and investigation resources.
Editor's Notes
- #2 Fidelis Collector Presentation – Public Information.
- #4 We covered the theory last time, this time we’re talking practical application
- #5 Were any of these the result of insider threat? Yes – Equifax (Negligent) and Marriott (They acquired the breach - Negligent) Edward Snowden. Air gap – data was physically moved from one medium to another - mention the length of the breach Marriott – The attackers remained in the system after Marriott acquired Stargroup. Source: https://www.csoonline.com/article/2130877/data-breach/the-biggest-data-breaches-of-the-21st-century.html
- #7 https://attack.mitre.org/techniques/T1041/
- #8 Baselining can be any number of things. Not just how much data, or where the data is coming from. Other things like 'people logging into their work stations at odd hours of the day'. If you log in between 9am and 5pm. Now, all of a sudden, that same user is logging in at 1am - there is a problem. In Network, we can apply an analytic rule - incoming connection on this port. The analytic rule can be applied to certain hours to catch anomalies. This will help you build a baseline between what's normal and what's note. Really it's about being able to identify the difference. What's normal & what's not. These are automated rules that can be set up, and there are also Data Science as a Service that we can apply to the baseline. Fidelis Offers Data Science as a Service - which helps customers create models to help establish baselines. Machine Learning plus targeted Human Learning & model creation is the utmost comprehensive way to establish baselines & anomalous behavior.
- #9 The ways in which Fidelis could sold this issue…
- #11 Generally, current solutions attempt to identify divergence from what is considered “normal” behavior for a given employee. When the software spots an anomaly, a small team investigates. While this method can be helpful, it usually falls short, for four reasons: By the time negative behaviors are detected, the breach has often already occurred. The organization is already at a disadvantage, and it cannot deploy an active defense. Monitoring for “divergence from normal behavior” creates a huge number of false positives, wasting much of the investigation team’s time. Serial bad actors may not be caught; malicious activity may be built into the baseline of “normal” activity. Collecting massive amounts of employee data creates privacy concerns and significant potential for abuse, and even gives off a high perception of privacy intrusion by end-users.
- #12 We address these concerns in very innovative ways Monitor and apply automatic analysis to all behavior, all the time. Integrate prevention, detection, investigation and remediation tools to allow for simultaneous operations. Automated detection, identification and classification of key assets and their alerts to minimize both dwell time and investigation resources. A program to combat any form of insider threat has to focus on detection through the techniques we’ve discussed. Since those cannot be replaced, they had to be improved.