‘Data violators’ have outpaced data defenders. But security and identity analytics can level the playing field. Learn how identity, access and security disciplines can benefit from: Risk-based authentication Data exfiltration identification Malicious insider activity disruption Adaptive access certification Presenter: Adam Evans, Solutions Consulting

1. Security & Identity
Analytics
How Security and Identity Analytics can Drive
Adaptive Defence
Adam Evans | Senior Identity & Access Specialist | 24th February 2016

2. Source: PwC 2016 Global State of Information Security Survey
(Responses from 10,000 CxOs in 127 countries 30% from Europe. Error margin <1%)
Hacking is Big Business…
The average annual
Monetary loss was
$2.5m (£1.75m)
per organisation

3. Finding the weak links – a full-time job
• Social media
• Link clickers
• Weak passwords

4. Adapting to Controls

5. “Enterprises are having a difficult
time hiring skilled people as it takes
53% of organisations between 3 and
6 months to fill a position and 10%
cannot fill them at all.”
Source: ISACA’s global survey, “The State of Cybersecurity: Implications for 2015”
Meanwhile, as the threat evolves…

6. Provide the limited
professionals we have
with the best information
for rapid decision making

7. Analytics applies algorithms or
machine learning to the
“advisor feeds” for specific use
cases

8. At Micro Focus, we believe that
Identity and Security Analytics
holds the greatest hope of leveling
the playing field with today’s
dynamic threats

9. Identity Analytics Use Cases

10. “Identity Analytics and Intelligence (IAI)
moves organisations toward a contextual,
dynamic, risk-based approach to identity
and access management.”
Source: Gartner

11. Risk-Based Authentication
• Use risk scoring to drive step-up authentication
• Static risk scoring can be assigned to the entitlement,
user, or application
• Add dynamic risk at request such as time of day, geo
location, IP address, or device
• Results can be shared back into the analytics engine
as an advisor feed

12. Bad Behavioral Analysis
• Machine learning and anomaly detection based on
identities
• Give privileged users insight into unusual activity with
their credentials
• Identify unusual patterns of access, changes and data
exfiltration
• Detect use of privileged account “backdoors”

13. Excessive Credential Detection
• Identify orphaned or rogue accounts based on login or
peer group analysis – revoke accounts and save on
SaaS licenses
• Compare employees being paid by HR, or contracts to
orphaned or rogue accounts

14. Adaptive Access Certifications
• Request immediate access certification for high-risk
transactions
• Prioritise the highest risk entitlements for access
certifications
• Indicate dormant accounts or outlier access compared
to peers
• Reduce rubber-stamping and increase revocation rates

15. Risk-Based ID & Access Provisioning
• Risk-informed access request and approval
• Policy improvement suggestions for roles or SOD
controls

16. Generally, identity analytics
provides better decision-
making information

17. Security Analytics Use Cases

18. Abnormal Sensitive File Access
• Unusual time of day for the user
• From a risky IP address, geographic location or
unknown machine
• With credentials that haven’t been used in a while

19. Abnormal Data Exfiltration
• Large data sets
• Data movement to USB drives or an unusual location

20. Abnormal File Changes
• File replacement outside of change windows
• Changes made by an abnormal user

21. Abnormal Password Resets
• Brute force attempts at self-service password resets
• Abnormal time, location or device for password resets

22. Generally, security analytics is
looking for abnormal activity

23. Enforce
Access
Controls
Monitor
User
Activity
Identity-Powered Security
Minimise
Rights
Analytics

24. The Micro Focus Approach
An Integrated Identity, Access & Security Solution
Access
Management &
Authentication
Secure
User
Monitoring
Identity Governance &
Administration
AnalyticsAnalytics

25. Identity Governance & Administration
Enforcing the Least-Privilege Principle
IGA
Access
Request
Help-Desk
Integration
Access
Review
Privileged
Identity
Management
Delegated
Administration
Business Policy
SOD & Roles
Identity
Management
Minimise Rights

26. Enforce Access Controls
AMA
Single Sign-On
(Web, Cloud,
Enterprise)
BYOI
BYOD
Multi-Factor
Authentication
Federation
Risk-Based
Adaptive
Authentication
Access Management and Authentication
A Secure Sign-on Experience

27. Monitor User Activity
SUMLog & Event
Correlation
SIEM
File
Integrity
Monitoring
Configuration
Assessment
Anomaly
Detection
Privileged
Session
Recording
Secure User Monitoring
Analytics - Identify Abnormal

28. Benefits of an Analytics
Approach…
• Targeted information for more efficient and
intelligent decision making
• Reduced data sifting to more rapidly identify and
eliminate threats
• Reduced overall risk with existing personnel
resources

29. Questions?

30. Thank You For Listening