SlideShare a Scribd company logo

Ken Czekaj & Robert Wright - Leveraging APM NPM Solutions to Compliment Cyber Defense Strategy

•
•
C
centralohioissa

This discussion will detail best practices and recommendations for using your Application Performance Management / Network Performance Management solutions. The focus is to work in tandem and compliment existing Cyber Security solutions.

Technology
1 of 33
Download to read offline
©2016 NETSCOUT ° CONFIDENTIAL & PROPRIETARY Leveraging APM NPM Solutions to Compliment Cyber Defense Strategy March 30, 2016 Central Ohio InfoSec Summit
A Little About Us …. Ken Czekaj • 28 Years in IT • Problem Solver @ NETSCOUT • Solutions Architect / Systems Engineering background ©2016 NETSCOUT ° PUBLIC 2 Robert Wright • 20 Years in IT • Sr. Solutions Engineer • Co-Founder NEOISF • Customer & Vendor background Our Blog http://problemsolverblog.czekaj.org
Philosophy and Approach • Cyber Security is everyone’s problem • Triage is Triage …. Cyber / Apps / Network …. all very similar • Lot’s of Excellent Security Tools Available in the Market • APM NPM Solutions can provide Additional Visibility & Analytics • Reduce your Triage time Bring All that you have available to the table !!!!! ©2016 NETSCOUT ° PUBLIC 3
©2016 NETSCOUT ° CONFIDENTIAL & PROPRIETARY 4 Denial of Service In addition to straight Layer 2 “Brute Force” … Think About … • Key Services Failures – DHCP DNS LDAP Radius • Application Targeted Attacks • Cloud Services • Call Centers & VoIP Service • SYN Floods
©2016 NETSCOUT ° CONFIDENTIAL & PROPRIETARY 5 Denial of Service - Granularity
©2016 NETSCOUT ° CONFIDENTIAL & PROPRIETARY 6 Denial of Service – DHCP
©2016 NETSCOUT ° CONFIDENTIAL & PROPRIETARY 7 Anomalous Behavior APM NPM solutions usually have their own analytics • Use the additional “set of eyes” to defend against the unknown • Same “anomaly” could be used by multiple IT groups • I.E. ….. View of a TCP Reset ??? – Security - “Could be a Bot…” – Network - “Lack of Server Resources..” – Application – “Uh Oh …”
©2016 NETSCOUT ° CONFIDENTIAL & PROPRIETARY 8 Anomalous Behavior
©2016 NETSCOUT ° CONFIDENTIAL & PROPRIETARY 9 Virtualized Architecture Most Cyber Security solutions have “North South” Visibility • APM NPM Solutions can provide additional visibility into “East West” traffic as well – VMWare – Citrix – HP Blade Servers – UCS Chassis
Virtualized Architecture Data Center Core Traffic typically travels “East West” Data Center Perimeter Internet, MPLS, Co-located PODs Typically “North – South” Traffic
©2016 NETSCOUT ° CONFIDENTIAL & PROPRIETARY 11 Authentication Services – LDAP RADIUS APM NPM solutions have significant views into authentication services • Information on Authentication service and more importantly “failures” • Excellent Views into Single Sign On deployments • Active Directory issues can also affect Cloud Apps • Radius performance issues affect (guest) wireless & BYOD
©2016 NETSCOUT ° CONFIDENTIAL & PROPRIETARY 12 Authentication Services – LDAP RADIUS
©2016 NETSCOUT ° CONFIDENTIAL & PROPRIETARY 13 Policy Based Alarms Many APM NPM solutions will have additional alarming • These do not limit traffic, but can be a direct corollary to bad application traffic • Examples …. We should never see – Outbound FTP from a Web Server – DHCP traffic in the DMZ – Unencrypted protocols in PCI CDE zone • Insight into “Zero-Day” Host issues
©2016 NETSCOUT ° CONFIDENTIAL & PROPRIETARY 14 Policy Based Alarms
©2016 NETSCOUT ° CONFIDENTIAL & PROPRIETARY 15 Packet Capture and Decode APM NPM solutions usually have back in time historical packet analysis • Sometimes, packets are the only way to see what really happened (they never lie) • Packets an be used for – Attack Reconstruction – Evidence
Packet Capture and Decode
©2016 NETSCOUT ° CONFIDENTIAL & PROPRIETARY 17 DNS Services APM NPM solutions have significant views into DNS services • Anomalies with DNS for usage and failures will affect almost every application – Many times mis-diagnosed as a Cyber event • Provide insights into DNS events – Hijacking – Poisoning – Malware phone home – Botnets – Data Exfiltration
©2016 NETSCOUT ° CONFIDENTIAL & PROPRIETARY 18 DNS Services
©2016 NETSCOUT ° CONFIDENTIAL & PROPRIETARY 19 PCI Compliance - V3.0 – V3.1 More credit card transactions now flying on networks than ever • PCI Requirements – You must have a logical flow of the application traffic – There are SSL version requirements to maintain compliance • View into the Cardholder Data Environment (CDE)
©2016 NETSCOUT ° CONFIDENTIAL & PROPRIETARY 20 PCI Compliance – V3.0 – V3.1
©2016 NETSCOUT ° CONFIDENTIAL & PROPRIETARY 21 Reporting & Evidence APM NPM solutions usually have reporting capabilities • Reports and Views can be leveraged in a post cyber event • Often easier than manually collecting the information and manually creating your own reports
©2016 NETSCOUT ° CONFIDENTIAL & PROPRIETARY 22 Reporting & Evidence
©2016 NETSCOUT ° CONFIDENTIAL & PROPRIETARY 23 Certificates and PKI APM NPM solutions usually have a view into Certificates • Validate identities as encrypted communications are established • Managed by spreadsheets – inaccuracy and manual toil • Alerts to avoid embarrassment for expirations or non- compliancy
©2016 NETSCOUT ° CONFIDENTIAL & PROPRIETARY 24 Certificates and PKI
©2016 NETSCOUT ° CONFIDENTIAL & PROPRIETARY 25 Meta Data Information APM NPM solutions usually have Meta Data that can help speed triage • Flows, Utilization, Applications, Top Talkers, All Talkers, Latency, Error Codes, etc. • While “packets” contain the evidence, Meta Data is more efficient workflow • Efficient and Fast methodology when you “don’t know” what you are looking for
©2016 NETSCOUT ° CONFIDENTIAL & PROPRIETARY 26 Meta Data Information
©2016 NETSCOUT ° CONFIDENTIAL & PROPRIETARY 27 Attack Reconstruction APM NPM solutions have functionality to reconstruct events • Packets and Meta Data can often yield fingerprint evidence of the attack – How did they get in? – What did they look at? – What information got compromised?
©2016 NETSCOUT ° CONFIDENTIAL & PROPRIETARY 28 Attack Reconstruction
©2016 NETSCOUT ° CONFIDENTIAL & PROPRIETARY 29 Host Analysis APM NPM solutions usually have detailed information on a Host • Easy to digest information about IP address traffic • Search information quickly • Can facilitate or re-route investigations • Acts as a filter to get to packet evidence
©2016 NETSCOUT ° CONFIDENTIAL & PROPRIETARY 30 Host Analysis
©2016 NETSCOUT ° CONFIDENTIAL & PROPRIETARY 31 Integration Points with Cyber Tools Many APM NPM tools have hooks, API’s or partnerships with Cyber Tools • Know what you have available in this area !!! • A trap sent to an event correlation engine, SIEM, or Big Data solution will help see the whole picture • Open API to request meta data directly out of APM NPM Solution
Contact Information Ken Czekaj • Ken.Czekaj@NETSCOUT.com • 419-433-6909 • Twitter - @KenCzekaj • LinkedIn • http://www.linkedin.com/in/kenczekaj ©2016 NETSCOUT ° PUBLIC 32 Robert Wright • Robert.Wright@NETSCOUT.com • 614-264-8604 • Twitter - @rjwrightohio • LinkedIn • https://www.linkedin.com/in/rjwrightohio Our Blog http://problemsolverblog.czekaj.org
©2016 NETSCOUT ° CONFIDENTIAL & PROPRIETARY 33 Summary In your Cyber Defense Strategy … Bring ALL of your AVAILABLE information and intelligence to the table !!!!!

Recommended

Bil Harmer - Myths of Cloud Security Debunked!
Bil Harmer - Myths of Cloud Security Debunked!Bil Harmer - Myths of Cloud Security Debunked!
Bil Harmer - Myths of Cloud Security Debunked!centralohioissa
 
Robert Hurlbut - Threat Modeling for Secure Software Design
Robert Hurlbut - Threat Modeling for Secure Software DesignRobert Hurlbut - Threat Modeling for Secure Software Design
Robert Hurlbut - Threat Modeling for Secure Software Designcentralohioissa
 
Jason Kent - AppSec Without Additional Tools
Jason Kent - AppSec Without Additional ToolsJason Kent - AppSec Without Additional Tools
Jason Kent - AppSec Without Additional Toolscentralohioissa
 
Lisa Guess - Embracing the Cloud
Lisa Guess - Embracing the CloudLisa Guess - Embracing the Cloud
Lisa Guess - Embracing the Cloudcentralohioissa
 
Jervis Hui - No Tradeoffs: Cloud Security & Privacy Don't Need To Be At Odds
Jervis Hui - No Tradeoffs: Cloud Security & Privacy Don't Need To Be At OddsJervis Hui - No Tradeoffs: Cloud Security & Privacy Don't Need To Be At Odds
Jervis Hui - No Tradeoffs: Cloud Security & Privacy Don't Need To Be At Oddscentralohioissa
 
Jack Nichelson - Information Security Metrics - Practical Security Metrics
Jack Nichelson - Information Security Metrics - Practical Security MetricsJack Nichelson - Information Security Metrics - Practical Security Metrics
Jack Nichelson - Information Security Metrics - Practical Security Metricscentralohioissa
 
Robert Brzezinski - Office 365 Security & Compliance: Cloudy Collaboration......
Robert Brzezinski - Office 365 Security & Compliance: Cloudy Collaboration......Robert Brzezinski - Office 365 Security & Compliance: Cloudy Collaboration......
Robert Brzezinski - Office 365 Security & Compliance: Cloudy Collaboration......centralohioissa
 
Gavin Hill - Lessons From the Human Immune System
Gavin Hill - Lessons From the Human Immune SystemGavin Hill - Lessons From the Human Immune System
Gavin Hill - Lessons From the Human Immune Systemcentralohioissa
 

Recommended

Bil Harmer - Myths of Cloud Security Debunked!
Bil Harmer - Myths of Cloud Security Debunked!Bil Harmer - Myths of Cloud Security Debunked!
Bil Harmer - Myths of Cloud Security Debunked!centralohioissa
 
Robert Hurlbut - Threat Modeling for Secure Software Design
Robert Hurlbut - Threat Modeling for Secure Software DesignRobert Hurlbut - Threat Modeling for Secure Software Design
Robert Hurlbut - Threat Modeling for Secure Software Designcentralohioissa
 
Jason Kent - AppSec Without Additional Tools
Jason Kent - AppSec Without Additional ToolsJason Kent - AppSec Without Additional Tools
Jason Kent - AppSec Without Additional Toolscentralohioissa
 
Lisa Guess - Embracing the Cloud
Lisa Guess - Embracing the CloudLisa Guess - Embracing the Cloud
Lisa Guess - Embracing the Cloudcentralohioissa
 
Jervis Hui - No Tradeoffs: Cloud Security & Privacy Don't Need To Be At Odds
Jervis Hui - No Tradeoffs: Cloud Security & Privacy Don't Need To Be At OddsJervis Hui - No Tradeoffs: Cloud Security & Privacy Don't Need To Be At Odds
Jervis Hui - No Tradeoffs: Cloud Security & Privacy Don't Need To Be At Oddscentralohioissa
 
Jack Nichelson - Information Security Metrics - Practical Security Metrics
Jack Nichelson - Information Security Metrics - Practical Security MetricsJack Nichelson - Information Security Metrics - Practical Security Metrics
Jack Nichelson - Information Security Metrics - Practical Security Metricscentralohioissa
 
Robert Brzezinski - Office 365 Security & Compliance: Cloudy Collaboration......
Robert Brzezinski - Office 365 Security & Compliance: Cloudy Collaboration......Robert Brzezinski - Office 365 Security & Compliance: Cloudy Collaboration......
Robert Brzezinski - Office 365 Security & Compliance: Cloudy Collaboration......centralohioissa
 
Gavin Hill - Lessons From the Human Immune System
Gavin Hill - Lessons From the Human Immune SystemGavin Hill - Lessons From the Human Immune System
Gavin Hill - Lessons From the Human Immune Systemcentralohioissa
 
Jason Harrell - Compliance and Security: Building a Cybersecurity Risk Manage...
Jason Harrell - Compliance and Security: Building a Cybersecurity Risk Manage...Jason Harrell - Compliance and Security: Building a Cybersecurity Risk Manage...
Jason Harrell - Compliance and Security: Building a Cybersecurity Risk Manage...centralohioissa
 
Database monitoring - First and Last Line of Defense
Database monitoring - First and Last Line of Defense Database monitoring - First and Last Line of Defense
Database monitoring - First and Last Line of Defense Imperva
 
All Hope is Not Lost Network Forensics Exposes Today's Advanced Security Thr...
All Hope is Not Lost Network Forensics Exposes Today's Advanced Security Thr...All Hope is Not Lost Network Forensics Exposes Today's Advanced Security Thr...
All Hope is Not Lost Network Forensics Exposes Today's Advanced Security Thr...Savvius, Inc
 
Chris Haley - Understanding Attackers' Use of Covert Communications
Chris Haley - Understanding Attackers' Use of Covert CommunicationsChris Haley - Understanding Attackers' Use of Covert Communications
Chris Haley - Understanding Attackers' Use of Covert Communicationscentralohioissa
 
Jake Williams - Navigating the FDA Recommendations on Medical Device Security...
Jake Williams - Navigating the FDA Recommendations on Medical Device Security...Jake Williams - Navigating the FDA Recommendations on Medical Device Security...
Jake Williams - Navigating the FDA Recommendations on Medical Device Security...centralohioissa
 
Hardware Security on Vehicles
Hardware Security on VehiclesHardware Security on Vehicles
Hardware Security on VehiclesPriyanka Aash
 
How Zero Trust Changes Identity & Access
How Zero Trust Changes Identity & AccessHow Zero Trust Changes Identity & Access
How Zero Trust Changes Identity & AccessIvan Dwyer
 
Hackers, Cyber Crime and Espionage
Hackers, Cyber Crime and EspionageHackers, Cyber Crime and Espionage
Hackers, Cyber Crime and EspionageImperva
 
BeyondCorp and Zero Trust
BeyondCorp and Zero TrustBeyondCorp and Zero Trust
BeyondCorp and Zero TrustIvan Dwyer
 
Managing risk and vulnerabilities in a business context
Managing risk and vulnerabilities in a business contextManaging risk and vulnerabilities in a business context
Managing risk and vulnerabilities in a business contextAlgoSec
 
The Non-Advanced Persistent Threat
The Non-Advanced Persistent ThreatThe Non-Advanced Persistent Threat
The Non-Advanced Persistent ThreatImperva
 
Why Zero Trust Yields Maximum Security
Why Zero Trust Yields Maximum SecurityWhy Zero Trust Yields Maximum Security
Why Zero Trust Yields Maximum SecurityPriyanka Aash
 
Zero trust in a hybrid architecture
Zero trust in a hybrid architectureZero trust in a hybrid architecture
Zero trust in a hybrid architectureHybrid IT Europe
 
BeyondCorp and Zero Trust
BeyondCorp and Zero TrustBeyondCorp and Zero Trust
BeyondCorp and Zero TrustIvan Dwyer
 
Be the Hunter
Be the Hunter Be the Hunter
Be the Hunter Rahul Neel Mani
 
The Subversive Six: Hidden Risk Points in ICS
The Subversive Six: Hidden Risk Points in ICSThe Subversive Six: Hidden Risk Points in ICS
The Subversive Six: Hidden Risk Points in ICSTripwire
 
Why Network and Endpoint Security Isn’t Enough
Why Network and Endpoint Security Isn’t EnoughWhy Network and Endpoint Security Isn’t Enough
Why Network and Endpoint Security Isn’t EnoughImperva
 
Sophisticated Incident Response Requires Sophisticated Activity Monitoring
Sophisticated Incident Response Requires Sophisticated Activity MonitoringSophisticated Incident Response Requires Sophisticated Activity Monitoring
Sophisticated Incident Response Requires Sophisticated Activity MonitoringImperva
 
Top 5 Cloud Security Predictions for 2016
Top 5 Cloud Security Predictions for 2016 Top 5 Cloud Security Predictions for 2016
Top 5 Cloud Security Predictions for 2016 Alert Logic
 
Man in the Cloud Attacks
Man in the Cloud AttacksMan in the Cloud Attacks
Man in the Cloud AttacksImperva
 
Skip the Security Slow Lane with VMware Cloud on AWS
Skip the Security Slow Lane with VMware Cloud on AWSSkip the Security Slow Lane with VMware Cloud on AWS
Skip the Security Slow Lane with VMware Cloud on AWSTrend Micro
 
Savvius_Introduction to workshop
Savvius_Introduction to workshopSavvius_Introduction to workshop
Savvius_Introduction to workshopSTelligence Company
 

More Related Content

What's hot

Jason Harrell - Compliance and Security: Building a Cybersecurity Risk Manage...
Jason Harrell - Compliance and Security: Building a Cybersecurity Risk Manage...Jason Harrell - Compliance and Security: Building a Cybersecurity Risk Manage...
Jason Harrell - Compliance and Security: Building a Cybersecurity Risk Manage...centralohioissa
 
Database monitoring - First and Last Line of Defense
Database monitoring - First and Last Line of Defense Database monitoring - First and Last Line of Defense
Database monitoring - First and Last Line of Defense Imperva
 
All Hope is Not Lost Network Forensics Exposes Today's Advanced Security Thr...
All Hope is Not Lost Network Forensics Exposes Today's Advanced Security Thr...All Hope is Not Lost Network Forensics Exposes Today's Advanced Security Thr...
All Hope is Not Lost Network Forensics Exposes Today's Advanced Security Thr...Savvius, Inc
 
Chris Haley - Understanding Attackers' Use of Covert Communications
Chris Haley - Understanding Attackers' Use of Covert CommunicationsChris Haley - Understanding Attackers' Use of Covert Communications
Chris Haley - Understanding Attackers' Use of Covert Communicationscentralohioissa
 
Jake Williams - Navigating the FDA Recommendations on Medical Device Security...
Jake Williams - Navigating the FDA Recommendations on Medical Device Security...Jake Williams - Navigating the FDA Recommendations on Medical Device Security...
Jake Williams - Navigating the FDA Recommendations on Medical Device Security...centralohioissa
 
Hardware Security on Vehicles
Hardware Security on VehiclesHardware Security on Vehicles
Hardware Security on VehiclesPriyanka Aash
 
How Zero Trust Changes Identity & Access
How Zero Trust Changes Identity & AccessHow Zero Trust Changes Identity & Access
How Zero Trust Changes Identity & AccessIvan Dwyer
 
Hackers, Cyber Crime and Espionage
Hackers, Cyber Crime and EspionageHackers, Cyber Crime and Espionage
Hackers, Cyber Crime and EspionageImperva
 
BeyondCorp and Zero Trust
BeyondCorp and Zero TrustBeyondCorp and Zero Trust
BeyondCorp and Zero TrustIvan Dwyer
 
Managing risk and vulnerabilities in a business context
Managing risk and vulnerabilities in a business contextManaging risk and vulnerabilities in a business context
Managing risk and vulnerabilities in a business contextAlgoSec
 
The Non-Advanced Persistent Threat
The Non-Advanced Persistent ThreatThe Non-Advanced Persistent Threat
The Non-Advanced Persistent ThreatImperva
 
Why Zero Trust Yields Maximum Security
Why Zero Trust Yields Maximum SecurityWhy Zero Trust Yields Maximum Security
Why Zero Trust Yields Maximum SecurityPriyanka Aash
 
Zero trust in a hybrid architecture
Zero trust in a hybrid architectureZero trust in a hybrid architecture
Zero trust in a hybrid architectureHybrid IT Europe
 
BeyondCorp and Zero Trust
BeyondCorp and Zero TrustBeyondCorp and Zero Trust
BeyondCorp and Zero TrustIvan Dwyer
 
The Subversive Six: Hidden Risk Points in ICS
The Subversive Six: Hidden Risk Points in ICSThe Subversive Six: Hidden Risk Points in ICS
The Subversive Six: Hidden Risk Points in ICSTripwire
 
Why Network and Endpoint Security Isn’t Enough
Why Network and Endpoint Security Isn’t EnoughWhy Network and Endpoint Security Isn’t Enough
Why Network and Endpoint Security Isn’t EnoughImperva
 
Sophisticated Incident Response Requires Sophisticated Activity Monitoring
Sophisticated Incident Response Requires Sophisticated Activity MonitoringSophisticated Incident Response Requires Sophisticated Activity Monitoring
Sophisticated Incident Response Requires Sophisticated Activity MonitoringImperva
 
Top 5 Cloud Security Predictions for 2016
Top 5 Cloud Security Predictions for 2016 Top 5 Cloud Security Predictions for 2016
Top 5 Cloud Security Predictions for 2016 Alert Logic
 
Man in the Cloud Attacks
Man in the Cloud AttacksMan in the Cloud Attacks
Man in the Cloud AttacksImperva
 

What's hot (20)

Jason Harrell - Compliance and Security: Building a Cybersecurity Risk Manage...
Jason Harrell - Compliance and Security: Building a Cybersecurity Risk Manage...Jason Harrell - Compliance and Security: Building a Cybersecurity Risk Manage...
Jason Harrell - Compliance and Security: Building a Cybersecurity Risk Manage...
 
Database monitoring - First and Last Line of Defense
Database monitoring - First and Last Line of Defense Database monitoring - First and Last Line of Defense
Database monitoring - First and Last Line of Defense
 
All Hope is Not Lost Network Forensics Exposes Today's Advanced Security Thr...
All Hope is Not Lost Network Forensics Exposes Today's Advanced Security Thr...All Hope is Not Lost Network Forensics Exposes Today's Advanced Security Thr...
All Hope is Not Lost Network Forensics Exposes Today's Advanced Security Thr...
 
Chris Haley - Understanding Attackers' Use of Covert Communications
Chris Haley - Understanding Attackers' Use of Covert CommunicationsChris Haley - Understanding Attackers' Use of Covert Communications
Chris Haley - Understanding Attackers' Use of Covert Communications
 
Jake Williams - Navigating the FDA Recommendations on Medical Device Security...
Jake Williams - Navigating the FDA Recommendations on Medical Device Security...Jake Williams - Navigating the FDA Recommendations on Medical Device Security...
Jake Williams - Navigating the FDA Recommendations on Medical Device Security...
 
Hardware Security on Vehicles
Hardware Security on VehiclesHardware Security on Vehicles
Hardware Security on Vehicles
 
How Zero Trust Changes Identity & Access
How Zero Trust Changes Identity & AccessHow Zero Trust Changes Identity & Access
How Zero Trust Changes Identity & Access
 
Hackers, Cyber Crime and Espionage
Hackers, Cyber Crime and EspionageHackers, Cyber Crime and Espionage
Hackers, Cyber Crime and Espionage
 
BeyondCorp and Zero Trust
BeyondCorp and Zero TrustBeyondCorp and Zero Trust
BeyondCorp and Zero Trust
 
Managing risk and vulnerabilities in a business context
Managing risk and vulnerabilities in a business contextManaging risk and vulnerabilities in a business context
Managing risk and vulnerabilities in a business context
 
The Non-Advanced Persistent Threat
The Non-Advanced Persistent ThreatThe Non-Advanced Persistent Threat
The Non-Advanced Persistent Threat
 
Why Zero Trust Yields Maximum Security
Why Zero Trust Yields Maximum SecurityWhy Zero Trust Yields Maximum Security
Why Zero Trust Yields Maximum Security
 
Zero trust in a hybrid architecture
Zero trust in a hybrid architectureZero trust in a hybrid architecture
Zero trust in a hybrid architecture
 
BeyondCorp and Zero Trust
BeyondCorp and Zero TrustBeyondCorp and Zero Trust
BeyondCorp and Zero Trust
 
Be the Hunter
Be the Hunter Be the Hunter
Be the Hunter
 
The Subversive Six: Hidden Risk Points in ICS
The Subversive Six: Hidden Risk Points in ICSThe Subversive Six: Hidden Risk Points in ICS
The Subversive Six: Hidden Risk Points in ICS
 
Why Network and Endpoint Security Isn’t Enough
Why Network and Endpoint Security Isn’t EnoughWhy Network and Endpoint Security Isn’t Enough
Why Network and Endpoint Security Isn’t Enough
 
Sophisticated Incident Response Requires Sophisticated Activity Monitoring
Sophisticated Incident Response Requires Sophisticated Activity MonitoringSophisticated Incident Response Requires Sophisticated Activity Monitoring
Sophisticated Incident Response Requires Sophisticated Activity Monitoring
 
Top 5 Cloud Security Predictions for 2016
Top 5 Cloud Security Predictions for 2016 Top 5 Cloud Security Predictions for 2016
Top 5 Cloud Security Predictions for 2016
 
Man in the Cloud Attacks
Man in the Cloud AttacksMan in the Cloud Attacks
Man in the Cloud Attacks
 

Similar to Ken Czekaj & Robert Wright - Leveraging APM NPM Solutions to Compliment Cyber Defense Strategy

Skip the Security Slow Lane with VMware Cloud on AWS
Skip the Security Slow Lane with VMware Cloud on AWSSkip the Security Slow Lane with VMware Cloud on AWS
Skip the Security Slow Lane with VMware Cloud on AWSTrend Micro
 
Savvius_Introduction to workshop
Savvius_Introduction to workshopSavvius_Introduction to workshop
Savvius_Introduction to workshopSTelligence Company
 
EAS-SEC Project
EAS-SEC ProjectEAS-SEC Project
EAS-SEC ProjectERPScan
 
18BC03_Discovery_Enables_Accurate_CMDB_Hinkle_DiscoverFinancial
18BC03_Discovery_Enables_Accurate_CMDB_Hinkle_DiscoverFinancial18BC03_Discovery_Enables_Accurate_CMDB_Hinkle_DiscoverFinancial
18BC03_Discovery_Enables_Accurate_CMDB_Hinkle_DiscoverFinancialTim Hinkle
 
Multi-Cloud Breaks IT Ops: Best Practices to De-Risk Your Cloud Strategy
Multi-Cloud Breaks IT Ops: Best Practices to De-Risk Your Cloud StrategyMulti-Cloud Breaks IT Ops: Best Practices to De-Risk Your Cloud Strategy
Multi-Cloud Breaks IT Ops: Best Practices to De-Risk Your Cloud StrategyThousandEyes
 
Managing a Widely Distributed Network
Managing a Widely Distributed Network Managing a Widely Distributed Network
Managing a Widely Distributed Network Savvius, Inc
 
Cisco Connect Ottawa 2018 dna assurance shortest path to network innocence
Cisco Connect Ottawa 2018 dna assurance shortest path to network innocenceCisco Connect Ottawa 2018 dna assurance shortest path to network innocence
Cisco Connect Ottawa 2018 dna assurance shortest path to network innocenceCisco Canada
 
Cisco connect winnipeg 2018 unlocking business value with network programma...
Cisco connect winnipeg 2018 unlocking business value with network programma...Cisco connect winnipeg 2018 unlocking business value with network programma...
Cisco connect winnipeg 2018 unlocking business value with network programma...Cisco Canada
 
Delivering Services Powered by Operational Data - Connected Services
Delivering Services Powered by Operational Data - Connected ServicesDelivering Services Powered by Operational Data - Connected Services
Delivering Services Powered by Operational Data - Connected ServicesOSIsoft, LLC
 
Stream Processing as Game Changer for Big Data and Internet of Things by Kai ...
Stream Processing as Game Changer for Big Data and Internet of Things by Kai ...Stream Processing as Game Changer for Big Data and Internet of Things by Kai ...
Stream Processing as Game Changer for Big Data and Internet of Things by Kai ...Big Data Spain
 
Streaming Analytics Comparison of Open Source Frameworks, Products, Cloud Ser...
Streaming Analytics Comparison of Open Source Frameworks, Products, Cloud Ser...Streaming Analytics Comparison of Open Source Frameworks, Products, Cloud Ser...
Streaming Analytics Comparison of Open Source Frameworks, Products, Cloud Ser...Kai Wähner
 
SolarWinds User Group - Hawaii November 2016
SolarWinds User Group - Hawaii November 2016SolarWinds User Group - Hawaii November 2016
SolarWinds User Group - Hawaii November 2016SolarWinds
 
Getting Additional Value from Logs and APM Data with AppDynamics Unified Anal...
Getting Additional Value from Logs and APM Data with AppDynamics Unified Anal...Getting Additional Value from Logs and APM Data with AppDynamics Unified Anal...
Getting Additional Value from Logs and APM Data with AppDynamics Unified Anal...AppDynamics
 
The Network Knows—Avi Freedman, CEO & Co-Founder of Kentik
The Network Knows—Avi Freedman, CEO & Co-Founder of Kentik The Network Knows—Avi Freedman, CEO & Co-Founder of Kentik
The Network Knows—Avi Freedman, CEO & Co-Founder of Kentik Outlyer
 
Lessons from an AWS outage and how to detect root cause of cloud service disr...
Lessons from an AWS outage and how to detect root cause of cloud service disr...Lessons from an AWS outage and how to detect root cause of cloud service disr...
Lessons from an AWS outage and how to detect root cause of cloud service disr...ThousandEyes
 
Endpoint Agent Part 2: Monitoring SaaS Apps from Anywhere
Endpoint Agent Part 2: Monitoring SaaS Apps from AnywhereEndpoint Agent Part 2: Monitoring SaaS Apps from Anywhere
Endpoint Agent Part 2: Monitoring SaaS Apps from AnywhereThousandEyes
 
apidays LIVE Australia - The Evolution of APIs: Events and the AsyncAPI speci...
apidays LIVE Australia - The Evolution of APIs: Events and the AsyncAPI speci...apidays LIVE Australia - The Evolution of APIs: Events and the AsyncAPI speci...
apidays LIVE Australia - The Evolution of APIs: Events and the AsyncAPI speci...apidays
 
CAP Big Data analytics detects anomalies in server log files
CAP Big Data analytics detects anomalies in server log filesCAP Big Data analytics detects anomalies in server log files
CAP Big Data analytics detects anomalies in server log filesMarkku Ranta
 
ONF & iSDX Webinar
ONF & iSDX WebinarONF & iSDX Webinar
ONF & iSDX WebinarKatie Hyman
 

Similar to Ken Czekaj & Robert Wright - Leveraging APM NPM Solutions to Compliment Cyber Defense Strategy (20)

Skip the Security Slow Lane with VMware Cloud on AWS
Skip the Security Slow Lane with VMware Cloud on AWSSkip the Security Slow Lane with VMware Cloud on AWS
Skip the Security Slow Lane with VMware Cloud on AWS
 
Savvius_Introduction to workshop
Savvius_Introduction to workshopSavvius_Introduction to workshop
Savvius_Introduction to workshop
 
EAS-SEC Project
EAS-SEC ProjectEAS-SEC Project
EAS-SEC Project
 
18BC03_Discovery_Enables_Accurate_CMDB_Hinkle_DiscoverFinancial
18BC03_Discovery_Enables_Accurate_CMDB_Hinkle_DiscoverFinancial18BC03_Discovery_Enables_Accurate_CMDB_Hinkle_DiscoverFinancial
18BC03_Discovery_Enables_Accurate_CMDB_Hinkle_DiscoverFinancial
 
Multi-Cloud Breaks IT Ops: Best Practices to De-Risk Your Cloud Strategy
Multi-Cloud Breaks IT Ops: Best Practices to De-Risk Your Cloud StrategyMulti-Cloud Breaks IT Ops: Best Practices to De-Risk Your Cloud Strategy
Multi-Cloud Breaks IT Ops: Best Practices to De-Risk Your Cloud Strategy
 
Managing a Widely Distributed Network
Managing a Widely Distributed Network Managing a Widely Distributed Network
Managing a Widely Distributed Network
 
Cisco Connect Ottawa 2018 dna assurance shortest path to network innocence
Cisco Connect Ottawa 2018 dna assurance shortest path to network innocenceCisco Connect Ottawa 2018 dna assurance shortest path to network innocence
Cisco Connect Ottawa 2018 dna assurance shortest path to network innocence
 
Cisco connect winnipeg 2018 unlocking business value with network programma...
Cisco connect winnipeg 2018 unlocking business value with network programma...Cisco connect winnipeg 2018 unlocking business value with network programma...
Cisco connect winnipeg 2018 unlocking business value with network programma...
 
Delivering Services Powered by Operational Data - Connected Services
Delivering Services Powered by Operational Data - Connected ServicesDelivering Services Powered by Operational Data - Connected Services
Delivering Services Powered by Operational Data - Connected Services
 
Stream Processing as Game Changer for Big Data and Internet of Things by Kai ...
Stream Processing as Game Changer for Big Data and Internet of Things by Kai ...Stream Processing as Game Changer for Big Data and Internet of Things by Kai ...
Stream Processing as Game Changer for Big Data and Internet of Things by Kai ...
 
Streaming Analytics Comparison of Open Source Frameworks, Products, Cloud Ser...
Streaming Analytics Comparison of Open Source Frameworks, Products, Cloud Ser...Streaming Analytics Comparison of Open Source Frameworks, Products, Cloud Ser...
Streaming Analytics Comparison of Open Source Frameworks, Products, Cloud Ser...
 
SolarWinds User Group - Hawaii November 2016
SolarWinds User Group - Hawaii November 2016SolarWinds User Group - Hawaii November 2016
SolarWinds User Group - Hawaii November 2016
 
Getting Additional Value from Logs and APM Data with AppDynamics Unified Anal...
Getting Additional Value from Logs and APM Data with AppDynamics Unified Anal...Getting Additional Value from Logs and APM Data with AppDynamics Unified Anal...
Getting Additional Value from Logs and APM Data with AppDynamics Unified Anal...
 
The Network Knows—Avi Freedman, CEO & Co-Founder of Kentik
The Network Knows—Avi Freedman, CEO & Co-Founder of Kentik The Network Knows—Avi Freedman, CEO & Co-Founder of Kentik
The Network Knows—Avi Freedman, CEO & Co-Founder of Kentik
 
Lessons from an AWS outage and how to detect root cause of cloud service disr...
Lessons from an AWS outage and how to detect root cause of cloud service disr...Lessons from an AWS outage and how to detect root cause of cloud service disr...
Lessons from an AWS outage and how to detect root cause of cloud service disr...
 
Endpoint Agent Part 2: Monitoring SaaS Apps from Anywhere
Endpoint Agent Part 2: Monitoring SaaS Apps from AnywhereEndpoint Agent Part 2: Monitoring SaaS Apps from Anywhere
Endpoint Agent Part 2: Monitoring SaaS Apps from Anywhere
 
apidays LIVE Australia - The Evolution of APIs: Events and the AsyncAPI speci...
apidays LIVE Australia - The Evolution of APIs: Events and the AsyncAPI speci...apidays LIVE Australia - The Evolution of APIs: Events and the AsyncAPI speci...
apidays LIVE Australia - The Evolution of APIs: Events and the AsyncAPI speci...
 
Cap server log file analytics
Cap server log file analyticsCap server log file analytics
Cap server log file analytics
 
CAP Big Data analytics detects anomalies in server log files
CAP Big Data analytics detects anomalies in server log filesCAP Big Data analytics detects anomalies in server log files
CAP Big Data analytics detects anomalies in server log files
 
ONF & iSDX Webinar
ONF & iSDX WebinarONF & iSDX Webinar
ONF & iSDX Webinar
 

More from centralohioissa

Mike Spaulding - Building an Application Security Program
Mike Spaulding - Building an Application Security ProgramMike Spaulding - Building an Application Security Program
Mike Spaulding - Building an Application Security Programcentralohioissa
 
Bob West - Educating the Board of Directors
Bob West - Educating the Board of DirectorsBob West - Educating the Board of Directors
Bob West - Educating the Board of Directorscentralohioissa
 
Mark Villinski - Top 10 Tips for Educating Employees about Cybersecurity
Mark Villinski - Top 10 Tips for Educating Employees about CybersecurityMark Villinski - Top 10 Tips for Educating Employees about Cybersecurity
Mark Villinski - Top 10 Tips for Educating Employees about Cybersecuritycentralohioissa
 
Valerie Thomas - All Your Door Belong to Me - Attacking Physical Access Systems
Valerie Thomas - All Your Door Belong to Me - Attacking Physical Access SystemsValerie Thomas - All Your Door Belong to Me - Attacking Physical Access Systems
Valerie Thomas - All Your Door Belong to Me - Attacking Physical Access Systemscentralohioissa
 
Dino Tsibouris & Mehmet Munur - Legal Perspective on Data Security for 2016
Dino Tsibouris & Mehmet Munur - Legal Perspective on Data Security for 2016Dino Tsibouris & Mehmet Munur - Legal Perspective on Data Security for 2016
Dino Tsibouris & Mehmet Munur - Legal Perspective on Data Security for 2016centralohioissa
 
Jeffrey Sweet - Third Party Risk Governance - Why? and How?
Jeffrey Sweet - Third Party Risk Governance - Why? and How?Jeffrey Sweet - Third Party Risk Governance - Why? and How?
Jeffrey Sweet - Third Party Risk Governance - Why? and How?centralohioissa
 
Steven Keil - BYODAWSCYW (Bring Your Own Device And Whatever Security Control...
Steven Keil - BYODAWSCYW (Bring Your Own Device And Whatever Security Control...Steven Keil - BYODAWSCYW (Bring Your Own Device And Whatever Security Control...
Steven Keil - BYODAWSCYW (Bring Your Own Device And Whatever Security Control...centralohioissa
 
Tre Smith - From Decision to Implementation: Who's On First?
Tre Smith - From Decision to Implementation: Who's On First?Tre Smith - From Decision to Implementation: Who's On First?
Tre Smith - From Decision to Implementation: Who's On First?centralohioissa
 
Gary Sheehan - Winning a Battle Doesn't Mean We Are Winning the War
Gary Sheehan - Winning a Battle Doesn't Mean We Are Winning the WarGary Sheehan - Winning a Battle Doesn't Mean We Are Winning the War
Gary Sheehan - Winning a Battle Doesn't Mean We Are Winning the Warcentralohioissa
 
Sean Whalen - How to Hack a Hospital
Sean Whalen - How to Hack a HospitalSean Whalen - How to Hack a Hospital
Sean Whalen - How to Hack a Hospitalcentralohioissa
 
Harry Regan - Disaster Recovery and Business Continuity - "It's never so bad ...
Harry Regan - Disaster Recovery and Business Continuity - "It's never so bad ...Harry Regan - Disaster Recovery and Business Continuity - "It's never so bad ...
Harry Regan - Disaster Recovery and Business Continuity - "It's never so bad ...centralohioissa
 
Rafeeq Rehman - Breaking the Phishing Attack Chain
Rafeeq Rehman - Breaking the Phishing Attack ChainRafeeq Rehman - Breaking the Phishing Attack Chain
Rafeeq Rehman - Breaking the Phishing Attack Chaincentralohioissa
 
Oliver Schuermann - Integrated Software in Networking - the Mystery of SDN
Oliver Schuermann - Integrated Software in Networking - the Mystery of SDNOliver Schuermann - Integrated Software in Networking - the Mystery of SDN
Oliver Schuermann - Integrated Software in Networking - the Mystery of SDNcentralohioissa
 
Michael Woolard - Gamify Awareness Training: Failure to engage is failure to ...
Michael Woolard - Gamify Awareness Training: Failure to engage is failure to ...Michael Woolard - Gamify Awareness Training: Failure to engage is failure to ...
Michael Woolard - Gamify Awareness Training: Failure to engage is failure to ...centralohioissa
 
Ruben Melendez - Economically Justifying IT Security Initiatives
Ruben Melendez - Economically Justifying IT Security InitiativesRuben Melendez - Economically Justifying IT Security Initiatives
Ruben Melendez - Economically Justifying IT Security Initiativescentralohioissa
 
Ed McCabe - Putting the Intelligence back in Threat Intelligence
Ed McCabe - Putting the Intelligence back in Threat IntelligenceEd McCabe - Putting the Intelligence back in Threat Intelligence
Ed McCabe - Putting the Intelligence back in Threat Intelligencecentralohioissa
 
Ofer Maor - Security Automation in the SDLC - Real World Cases
Ofer Maor - Security Automation in the SDLC - Real World CasesOfer Maor - Security Automation in the SDLC - Real World Cases
Ofer Maor - Security Automation in the SDLC - Real World Casescentralohioissa
 
Jim Libersky: Cyber Security - Super Bowl 50
Jim Libersky: Cyber Security - Super Bowl 50Jim Libersky: Cyber Security - Super Bowl 50
Jim Libersky: Cyber Security - Super Bowl 50centralohioissa
 
Jim Wojno: Incident Response - No Pain, No Gain!
Jim Wojno: Incident Response - No Pain, No Gain!Jim Wojno: Incident Response - No Pain, No Gain!
Jim Wojno: Incident Response - No Pain, No Gain!centralohioissa
 
Jason Samide - State of Security & 2016 Predictions
Jason Samide - State of Security & 2016 PredictionsJason Samide - State of Security & 2016 Predictions
Jason Samide - State of Security & 2016 Predictionscentralohioissa
 

More from centralohioissa (20)

Mike Spaulding - Building an Application Security Program
Mike Spaulding - Building an Application Security ProgramMike Spaulding - Building an Application Security Program
Mike Spaulding - Building an Application Security Program
 
Bob West - Educating the Board of Directors
Bob West - Educating the Board of DirectorsBob West - Educating the Board of Directors
Bob West - Educating the Board of Directors
 
Mark Villinski - Top 10 Tips for Educating Employees about Cybersecurity
Mark Villinski - Top 10 Tips for Educating Employees about CybersecurityMark Villinski - Top 10 Tips for Educating Employees about Cybersecurity
Mark Villinski - Top 10 Tips for Educating Employees about Cybersecurity
 
Valerie Thomas - All Your Door Belong to Me - Attacking Physical Access Systems
Valerie Thomas - All Your Door Belong to Me - Attacking Physical Access SystemsValerie Thomas - All Your Door Belong to Me - Attacking Physical Access Systems
Valerie Thomas - All Your Door Belong to Me - Attacking Physical Access Systems
 
Dino Tsibouris & Mehmet Munur - Legal Perspective on Data Security for 2016
Dino Tsibouris & Mehmet Munur - Legal Perspective on Data Security for 2016Dino Tsibouris & Mehmet Munur - Legal Perspective on Data Security for 2016
Dino Tsibouris & Mehmet Munur - Legal Perspective on Data Security for 2016
 
Jeffrey Sweet - Third Party Risk Governance - Why? and How?
Jeffrey Sweet - Third Party Risk Governance - Why? and How?Jeffrey Sweet - Third Party Risk Governance - Why? and How?
Jeffrey Sweet - Third Party Risk Governance - Why? and How?
 
Steven Keil - BYODAWSCYW (Bring Your Own Device And Whatever Security Control...
Steven Keil - BYODAWSCYW (Bring Your Own Device And Whatever Security Control...Steven Keil - BYODAWSCYW (Bring Your Own Device And Whatever Security Control...
Steven Keil - BYODAWSCYW (Bring Your Own Device And Whatever Security Control...
 
Tre Smith - From Decision to Implementation: Who's On First?
Tre Smith - From Decision to Implementation: Who's On First?Tre Smith - From Decision to Implementation: Who's On First?
Tre Smith - From Decision to Implementation: Who's On First?
 
Gary Sheehan - Winning a Battle Doesn't Mean We Are Winning the War
Gary Sheehan - Winning a Battle Doesn't Mean We Are Winning the WarGary Sheehan - Winning a Battle Doesn't Mean We Are Winning the War
Gary Sheehan - Winning a Battle Doesn't Mean We Are Winning the War
 
Sean Whalen - How to Hack a Hospital
Sean Whalen - How to Hack a HospitalSean Whalen - How to Hack a Hospital
Sean Whalen - How to Hack a Hospital
 
Harry Regan - Disaster Recovery and Business Continuity - "It's never so bad ...
Harry Regan - Disaster Recovery and Business Continuity - "It's never so bad ...Harry Regan - Disaster Recovery and Business Continuity - "It's never so bad ...
Harry Regan - Disaster Recovery and Business Continuity - "It's never so bad ...
 
Rafeeq Rehman - Breaking the Phishing Attack Chain
Rafeeq Rehman - Breaking the Phishing Attack ChainRafeeq Rehman - Breaking the Phishing Attack Chain
Rafeeq Rehman - Breaking the Phishing Attack Chain
 
Oliver Schuermann - Integrated Software in Networking - the Mystery of SDN
Oliver Schuermann - Integrated Software in Networking - the Mystery of SDNOliver Schuermann - Integrated Software in Networking - the Mystery of SDN
Oliver Schuermann - Integrated Software in Networking - the Mystery of SDN
 
Michael Woolard - Gamify Awareness Training: Failure to engage is failure to ...
Michael Woolard - Gamify Awareness Training: Failure to engage is failure to ...Michael Woolard - Gamify Awareness Training: Failure to engage is failure to ...
Michael Woolard - Gamify Awareness Training: Failure to engage is failure to ...
 
Ruben Melendez - Economically Justifying IT Security Initiatives
Ruben Melendez - Economically Justifying IT Security InitiativesRuben Melendez - Economically Justifying IT Security Initiatives
Ruben Melendez - Economically Justifying IT Security Initiatives
 
Ed McCabe - Putting the Intelligence back in Threat Intelligence
Ed McCabe - Putting the Intelligence back in Threat IntelligenceEd McCabe - Putting the Intelligence back in Threat Intelligence
Ed McCabe - Putting the Intelligence back in Threat Intelligence
 
Ofer Maor - Security Automation in the SDLC - Real World Cases
Ofer Maor - Security Automation in the SDLC - Real World CasesOfer Maor - Security Automation in the SDLC - Real World Cases
Ofer Maor - Security Automation in the SDLC - Real World Cases
 
Jim Libersky: Cyber Security - Super Bowl 50
Jim Libersky: Cyber Security - Super Bowl 50Jim Libersky: Cyber Security - Super Bowl 50
Jim Libersky: Cyber Security - Super Bowl 50
 
Jim Wojno: Incident Response - No Pain, No Gain!
Jim Wojno: Incident Response - No Pain, No Gain!Jim Wojno: Incident Response - No Pain, No Gain!
Jim Wojno: Incident Response - No Pain, No Gain!
 
Jason Samide - State of Security & 2016 Predictions
Jason Samide - State of Security & 2016 PredictionsJason Samide - State of Security & 2016 Predictions
Jason Samide - State of Security & 2016 Predictions
 

Recently uploaded

Designing IA for AI - Information Architecture Conference 2024
Designing IA for AI - Information Architecture Conference 2024Designing IA for AI - Information Architecture Conference 2024
Designing IA for AI - Information Architecture Conference 2024Enterprise Knowledge
 
Beyond Boundaries: Leveraging No-Code Solutions for Industry Innovation
Beyond Boundaries: Leveraging No-Code Solutions for Industry InnovationBeyond Boundaries: Leveraging No-Code Solutions for Industry Innovation
Beyond Boundaries: Leveraging No-Code Solutions for Industry InnovationSafe Software
 
Story boards and shot lists for my a level piece
Story boards and shot lists for my a level pieceStory boards and shot lists for my a level piece
Story boards and shot lists for my a level piececharlottematthew16
 
"LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks...
"LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks..."LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks...
"LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks...Fwdays
 
SQL Database Design For Developers at php[tek] 2024
SQL Database Design For Developers at php[tek] 2024SQL Database Design For Developers at php[tek] 2024
SQL Database Design For Developers at php[tek] 2024Scott Keck-Warren
 
Streamlining Python Development: A Guide to a Modern Project Setup
Streamlining Python Development: A Guide to a Modern Project SetupStreamlining Python Development: A Guide to a Modern Project Setup
Streamlining Python Development: A Guide to a Modern Project SetupFlorian Wilhelm
 
Understanding the Laravel MVC Architecture
Understanding the Laravel MVC ArchitectureUnderstanding the Laravel MVC Architecture
Understanding the Laravel MVC ArchitecturePixlogix Infotech
 
"Federated learning: out of reach no matter how close",Oleksandr Lapshyn
"Federated learning: out of reach no matter how close",Oleksandr Lapshyn"Federated learning: out of reach no matter how close",Oleksandr Lapshyn
"Federated learning: out of reach no matter how close",Oleksandr LapshynFwdays
 
Pigging Solutions in Pet Food Manufacturing
Pigging Solutions in Pet Food ManufacturingPigging Solutions in Pet Food Manufacturing
Pigging Solutions in Pet Food ManufacturingPigging Solutions
 
"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack
"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack
"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek SchlawackFwdays
 
SAP Build Work Zone - Overview L2-L3.pptx
SAP Build Work Zone - Overview L2-L3.pptxSAP Build Work Zone - Overview L2-L3.pptx
SAP Build Work Zone - Overview L2-L3.pptxNavinnSomaal
 
Gen AI in Business - Global Trends Report 2024.pdf
Gen AI in Business - Global Trends Report 2024.pdfGen AI in Business - Global Trends Report 2024.pdf
Gen AI in Business - Global Trends Report 2024.pdfAddepto
 
AI as an Interface for Commercial Buildings
AI as an Interface for Commercial BuildingsAI as an Interface for Commercial Buildings
AI as an Interface for Commercial BuildingsMemoori
 
Developer Data Modeling Mistakes: From Postgres to NoSQL
Developer Data Modeling Mistakes: From Postgres to NoSQLDeveloper Data Modeling Mistakes: From Postgres to NoSQL
Developer Data Modeling Mistakes: From Postgres to NoSQLScyllaDB
 
Install Stable Diffusion in windows machine
Install Stable Diffusion in windows machineInstall Stable Diffusion in windows machine
Install Stable Diffusion in windows machinePadma Pradeep
 
Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024BookNet Canada
 
SIP trunking in Janus @ Kamailio World 2024
SIP trunking in Janus @ Kamailio World 2024SIP trunking in Janus @ Kamailio World 2024
SIP trunking in Janus @ Kamailio World 2024Lorenzo Miniero
 
Scanning the Internet for External Cloud Exposures via SSL Certs
Scanning the Internet for External Cloud Exposures via SSL CertsScanning the Internet for External Cloud Exposures via SSL Certs
Scanning the Internet for External Cloud Exposures via SSL CertsRizwan Syed
 

Recently uploaded (20)

Designing IA for AI - Information Architecture Conference 2024
Designing IA for AI - Information Architecture Conference 2024Designing IA for AI - Information Architecture Conference 2024
Designing IA for AI - Information Architecture Conference 2024
 
Beyond Boundaries: Leveraging No-Code Solutions for Industry Innovation
Beyond Boundaries: Leveraging No-Code Solutions for Industry InnovationBeyond Boundaries: Leveraging No-Code Solutions for Industry Innovation
Beyond Boundaries: Leveraging No-Code Solutions for Industry Innovation
 
Story boards and shot lists for my a level piece
Story boards and shot lists for my a level pieceStory boards and shot lists for my a level piece
Story boards and shot lists for my a level piece
 
"LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks...
"LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks..."LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks...
"LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks...
 
SQL Database Design For Developers at php[tek] 2024
SQL Database Design For Developers at php[tek] 2024SQL Database Design For Developers at php[tek] 2024
SQL Database Design For Developers at php[tek] 2024
 
Streamlining Python Development: A Guide to a Modern Project Setup
Streamlining Python Development: A Guide to a Modern Project SetupStreamlining Python Development: A Guide to a Modern Project Setup
Streamlining Python Development: A Guide to a Modern Project Setup
 
Understanding the Laravel MVC Architecture
Understanding the Laravel MVC ArchitectureUnderstanding the Laravel MVC Architecture
Understanding the Laravel MVC Architecture
 
Hot Sexy call girls in Panjabi Bagh 🔝 9953056974 🔝 Delhi escort Service
Hot Sexy call girls in Panjabi Bagh 🔝 9953056974 🔝 Delhi escort ServiceHot Sexy call girls in Panjabi Bagh 🔝 9953056974 🔝 Delhi escort Service
Hot Sexy call girls in Panjabi Bagh 🔝 9953056974 🔝 Delhi escort Service
 
"Federated learning: out of reach no matter how close",Oleksandr Lapshyn
"Federated learning: out of reach no matter how close",Oleksandr Lapshyn"Federated learning: out of reach no matter how close",Oleksandr Lapshyn
"Federated learning: out of reach no matter how close",Oleksandr Lapshyn
 
Pigging Solutions in Pet Food Manufacturing
Pigging Solutions in Pet Food ManufacturingPigging Solutions in Pet Food Manufacturing
Pigging Solutions in Pet Food Manufacturing
 
E-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptx
E-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptxE-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptx
E-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptx
 
"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack
"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack
"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack
 
SAP Build Work Zone - Overview L2-L3.pptx
SAP Build Work Zone - Overview L2-L3.pptxSAP Build Work Zone - Overview L2-L3.pptx
SAP Build Work Zone - Overview L2-L3.pptx
 
Gen AI in Business - Global Trends Report 2024.pdf
Gen AI in Business - Global Trends Report 2024.pdfGen AI in Business - Global Trends Report 2024.pdf
Gen AI in Business - Global Trends Report 2024.pdf
 
AI as an Interface for Commercial Buildings
AI as an Interface for Commercial BuildingsAI as an Interface for Commercial Buildings
AI as an Interface for Commercial Buildings
 
Developer Data Modeling Mistakes: From Postgres to NoSQL
Developer Data Modeling Mistakes: From Postgres to NoSQLDeveloper Data Modeling Mistakes: From Postgres to NoSQL
Developer Data Modeling Mistakes: From Postgres to NoSQL
 
Install Stable Diffusion in windows machine
Install Stable Diffusion in windows machineInstall Stable Diffusion in windows machine
Install Stable Diffusion in windows machine
 
Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
 
SIP trunking in Janus @ Kamailio World 2024
SIP trunking in Janus @ Kamailio World 2024SIP trunking in Janus @ Kamailio World 2024
SIP trunking in Janus @ Kamailio World 2024
 
Scanning the Internet for External Cloud Exposures via SSL Certs
Scanning the Internet for External Cloud Exposures via SSL CertsScanning the Internet for External Cloud Exposures via SSL Certs
Scanning the Internet for External Cloud Exposures via SSL Certs
 

Ken Czekaj & Robert Wright - Leveraging APM NPM Solutions to Compliment Cyber Defense Strategy

  • 1. ©2016 NETSCOUT ° CONFIDENTIAL & PROPRIETARY Leveraging APM NPM Solutions to Compliment Cyber Defense Strategy March 30, 2016 Central Ohio InfoSec Summit
  • 2. A Little About Us …. Ken Czekaj • 28 Years in IT • Problem Solver @ NETSCOUT • Solutions Architect / Systems Engineering background ©2016 NETSCOUT ° PUBLIC 2 Robert Wright • 20 Years in IT • Sr. Solutions Engineer • Co-Founder NEOISF • Customer & Vendor background Our Blog http://problemsolverblog.czekaj.org
  • 3. Philosophy and Approach • Cyber Security is everyone’s problem • Triage is Triage …. Cyber / Apps / Network …. all very similar • Lot’s of Excellent Security Tools Available in the Market • APM NPM Solutions can provide Additional Visibility & Analytics • Reduce your Triage time Bring All that you have available to the table !!!!! ©2016 NETSCOUT ° PUBLIC 3
  • 4. ©2016 NETSCOUT ° CONFIDENTIAL & PROPRIETARY 4 Denial of Service In addition to straight Layer 2 “Brute Force” … Think About … • Key Services Failures – DHCP DNS LDAP Radius • Application Targeted Attacks • Cloud Services • Call Centers & VoIP Service • SYN Floods
  • 5. ©2016 NETSCOUT ° CONFIDENTIAL & PROPRIETARY 5 Denial of Service - Granularity
  • 6. ©2016 NETSCOUT ° CONFIDENTIAL & PROPRIETARY 6 Denial of Service – DHCP
  • 7. ©2016 NETSCOUT ° CONFIDENTIAL & PROPRIETARY 7 Anomalous Behavior APM NPM solutions usually have their own analytics • Use the additional “set of eyes” to defend against the unknown • Same “anomaly” could be used by multiple IT groups • I.E. ….. View of a TCP Reset ??? – Security - “Could be a Bot…” – Network - “Lack of Server Resources..” – Application – “Uh Oh …”
  • 8. ©2016 NETSCOUT ° CONFIDENTIAL & PROPRIETARY 8 Anomalous Behavior
  • 9. ©2016 NETSCOUT ° CONFIDENTIAL & PROPRIETARY 9 Virtualized Architecture Most Cyber Security solutions have “North South” Visibility • APM NPM Solutions can provide additional visibility into “East West” traffic as well – VMWare – Citrix – HP Blade Servers – UCS Chassis
  • 10. Virtualized Architecture Data Center Core Traffic typically travels “East West” Data Center Perimeter Internet, MPLS, Co-located PODs Typically “North – South” Traffic
  • 11. ©2016 NETSCOUT ° CONFIDENTIAL & PROPRIETARY 11 Authentication Services – LDAP RADIUS APM NPM solutions have significant views into authentication services • Information on Authentication service and more importantly “failures” • Excellent Views into Single Sign On deployments • Active Directory issues can also affect Cloud Apps • Radius performance issues affect (guest) wireless & BYOD
  • 12. ©2016 NETSCOUT ° CONFIDENTIAL & PROPRIETARY 12 Authentication Services – LDAP RADIUS
  • 13. ©2016 NETSCOUT ° CONFIDENTIAL & PROPRIETARY 13 Policy Based Alarms Many APM NPM solutions will have additional alarming • These do not limit traffic, but can be a direct corollary to bad application traffic • Examples …. We should never see – Outbound FTP from a Web Server – DHCP traffic in the DMZ – Unencrypted protocols in PCI CDE zone • Insight into “Zero-Day” Host issues
  • 14. ©2016 NETSCOUT ° CONFIDENTIAL & PROPRIETARY 14 Policy Based Alarms
  • 15. ©2016 NETSCOUT ° CONFIDENTIAL & PROPRIETARY 15 Packet Capture and Decode APM NPM solutions usually have back in time historical packet analysis • Sometimes, packets are the only way to see what really happened (they never lie) • Packets an be used for – Attack Reconstruction – Evidence
  • 17. ©2016 NETSCOUT ° CONFIDENTIAL & PROPRIETARY 17 DNS Services APM NPM solutions have significant views into DNS services • Anomalies with DNS for usage and failures will affect almost every application – Many times mis-diagnosed as a Cyber event • Provide insights into DNS events – Hijacking – Poisoning – Malware phone home – Botnets – Data Exfiltration
  • 18. ©2016 NETSCOUT ° CONFIDENTIAL & PROPRIETARY 18 DNS Services
  • 19. ©2016 NETSCOUT ° CONFIDENTIAL & PROPRIETARY 19 PCI Compliance - V3.0 – V3.1 More credit card transactions now flying on networks than ever • PCI Requirements – You must have a logical flow of the application traffic – There are SSL version requirements to maintain compliance • View into the Cardholder Data Environment (CDE)
  • 20. ©2016 NETSCOUT ° CONFIDENTIAL & PROPRIETARY 20 PCI Compliance – V3.0 – V3.1
  • 21. ©2016 NETSCOUT ° CONFIDENTIAL & PROPRIETARY 21 Reporting & Evidence APM NPM solutions usually have reporting capabilities • Reports and Views can be leveraged in a post cyber event • Often easier than manually collecting the information and manually creating your own reports
  • 22. ©2016 NETSCOUT ° CONFIDENTIAL & PROPRIETARY 22 Reporting & Evidence
  • 23. ©2016 NETSCOUT ° CONFIDENTIAL & PROPRIETARY 23 Certificates and PKI APM NPM solutions usually have a view into Certificates • Validate identities as encrypted communications are established • Managed by spreadsheets – inaccuracy and manual toil • Alerts to avoid embarrassment for expirations or non- compliancy
  • 24. ©2016 NETSCOUT ° CONFIDENTIAL & PROPRIETARY 24 Certificates and PKI
  • 25. ©2016 NETSCOUT ° CONFIDENTIAL & PROPRIETARY 25 Meta Data Information APM NPM solutions usually have Meta Data that can help speed triage • Flows, Utilization, Applications, Top Talkers, All Talkers, Latency, Error Codes, etc. • While “packets” contain the evidence, Meta Data is more efficient workflow • Efficient and Fast methodology when you “don’t know” what you are looking for
  • 26. ©2016 NETSCOUT ° CONFIDENTIAL & PROPRIETARY 26 Meta Data Information
  • 27. ©2016 NETSCOUT ° CONFIDENTIAL & PROPRIETARY 27 Attack Reconstruction APM NPM solutions have functionality to reconstruct events • Packets and Meta Data can often yield fingerprint evidence of the attack – How did they get in? – What did they look at? – What information got compromised?
  • 28. ©2016 NETSCOUT ° CONFIDENTIAL & PROPRIETARY 28 Attack Reconstruction
  • 29. ©2016 NETSCOUT ° CONFIDENTIAL & PROPRIETARY 29 Host Analysis APM NPM solutions usually have detailed information on a Host • Easy to digest information about IP address traffic • Search information quickly • Can facilitate or re-route investigations • Acts as a filter to get to packet evidence
  • 30. ©2016 NETSCOUT ° CONFIDENTIAL & PROPRIETARY 30 Host Analysis
  • 31. ©2016 NETSCOUT ° CONFIDENTIAL & PROPRIETARY 31 Integration Points with Cyber Tools Many APM NPM tools have hooks, API’s or partnerships with Cyber Tools • Know what you have available in this area !!! • A trap sent to an event correlation engine, SIEM, or Big Data solution will help see the whole picture • Open API to request meta data directly out of APM NPM Solution
  • 32. Contact Information Ken Czekaj • Ken.Czekaj@NETSCOUT.com • 419-433-6909 • Twitter - @KenCzekaj • LinkedIn • http://www.linkedin.com/in/kenczekaj ©2016 NETSCOUT ° PUBLIC 32 Robert Wright • Robert.Wright@NETSCOUT.com • 614-264-8604 • Twitter - @rjwrightohio • LinkedIn • https://www.linkedin.com/in/rjwrightohio Our Blog http://problemsolverblog.czekaj.org
  • 33. ©2016 NETSCOUT ° CONFIDENTIAL & PROPRIETARY 33 Summary In your Cyber Defense Strategy … Bring ALL of your AVAILABLE information and intelligence to the table !!!!!