Cyber Defense Challenges -Real-time network visibility -Limited network automation -Making sense of the data Adaptive Network Automation Applied to Cyber Defense -Visualize -Automate -Integrate

1. NetBrain Technologies
15 Network Drive
Burlington, MA 01803
NetBrain Technologies
15 Network Drive
Burlington, MA 01803
NetBrain Technologies
15 Network Drive
Burlington, MA 01803
+1 800.605.7964
info@netbraintech.com
www.netbraintech.com
Network Automation in Support of
Cyber Defense
Rick Larkin
Senior Network Engineer
NetBrain Technologies, Inc
27 June 2017

2. 2 | © Copyright NetBrain® Internal Confidential
Agenda
o Cyber Defense Challenges
 Real-time network visibility
 Limited network automation
 Making sense of the data
o Adaptive Network Automation Applied to Cyber Defense
 Visualize
 Automate
 Integrate

3. NetBrain Technologies
15 Network Drive
Burlington, MA 01803
Internal Confidential
Cyber Defense Challenges
Need for visualization, automation and integration

4. 4 | © Copyright NetBrain® Internal Confidential
Cyber Defense Challenges
“We do not have great situational awareness holistically over the battlespace, over the networks
– we just don’t. It does not exist. That’s a critical gap” -
VADM Gilday, Defensesystems.com, May 12th 2016
“We will ruthlessly automate.
As we automate more things,
we will free up labor to move into those higher-level functions
where the computer isn’t smart enough to figure out yet.
We will automate everything but leadership.”
Dr. Travis, DISA Signal Magazine, April 1, 2017

5. 5 | © Copyright NetBrain® Internal Confidential
Three Critical Challenges
o Lack of Real-Time Network Visibility
» Traditional methods don’t work. Example: Static Network Maps.
» Need “real-time” network visualization, end to end, to the IP/port level
o Limited Network Automation
» Current network automation has limited functional scope, needs to be
o Data-driven
o Simplified and Dynamically created
o Making sense of the data
» Cyber Ops Teams struggle with Too Much Information
» Need better data visualization and “sense making” capabilities to create
Actionable Intelligence

6. NetBrain Technologies
15 Network Drive
Burlington, MA 01803
Internal Confidential
Adaptive Network Automation
Use Cases

7. 7 | © Copyright NetBrain® Internal Confidential
Solution: Adaptive Network Automation Platform
Network – Physical, Virtual & SDN
Executable Applications & Runbooks:
Automate network management and manual tasksAutomate
Dynamic Map:
See what’s happening to the network through
end-to-end network visibility – port/IP level
Visualize
Visualize
Rich API framework:
Increase collaboration by integrating
security and troubleshooting workflows
Integrate

8. 8 | © Copyright NetBrain® Internal Confidential
Visualize: Dynamic Map
» Dynamic Map
o Data driven network map based on relevant information for the task at hand
o Additional data layers can be added from historical information, real-time or 3rd party applications

9. 9 | © Copyright NetBrain® Internal Confidential
Use Case - Visualize: Application Flow across the Network

10. 10 | © Copyright NetBrain® Internal Confidential
Automate: Executable Intelligence
Download Executable
Intelligence
Run Adaptive
Network Automation
Comprehensive
Data Model
• Topology
• Design
• History
Define Automation Task
via Dynamic Map
• NetOps
• CyberOps
• CPTs
• SOC/NOC
• IA/ISSM
• Architecture
• Design
• IDS
• IPS
• Firewall
• NetFlow Data
• SIEM
• Big Data Analytics

11. 11 | © Copyright NetBrain® Internal Confidential
Use Case - Automate: Compliance
o Automated Compliance validation & verification
» NIST RMF, DISA/NSA STIGs, IAVAs, CC/S/A specific
o Proactive NetOps & CyberOps
» Automation technology can help CPTs, as well as on-site Network & IA staff
» Validation on a live network, in real-time, to detect “compliance drift”

12. 12 | © Copyright NetBrain® Internal Confidential
Integrate: Map as a Single Pane Of Glass
» Automated Analysis – Fully Customizable
» Execute manual tasks in seconds
» Initiated by operators or automatically from integrated systems like IDS/IPS, Trouble Tickets, SIEM or
CMDB.

13. 13 | © Copyright NetBrain® Internal Confidential
Use Case - Integrate: Automate Workflows
A SIEM event or trouble
ticket triggers a diagnosis
A Help Desk Engineers
reviews the diagnostic
data
Engineer performs
additional (pre-built)
diagnoses
Help Desk Escalates to
CyberOps with custom
notes and data
CyberOps and NetOps
work together from a
single map
After the problem is resolved, a
CyberOps engineer enhances
the knowledge library with
lessons-learned
1
2
3
4
5
6

14. 14 | © Copyright NetBrain® Internal Confidential
Use Case - Integrate: Triggered Diagnosis

15. NetBrain Technologies
15 Network Drive
Burlington, MA 01803
Internal Confidential
Summary
Adaptive Network Automation
Improves Collaboration

16. 16 | © Copyright NetBrain® Internal Confidential
Recent Event from DHS CERT
https://www.us-cert.gov/ncas/alerts/TA17-117A

17. 17 | © Copyright NetBrain® Internal Confidential
o Cyber Event Management – Automation can significantly reduce response time
o Allows for collaboration between NetOps & CyberOps, as well as Tiered Teams.
o Runbooks automate Playbooks in response to Asymmetric Cyber threats.
NetOps CyberOps
Vendor
Management
Summary“If you can't understand [your networks], you can't defend them - it's as simple as that,“
Vice Adm. Michael Gilday, Commander, US Fleet Cyber Command & US 10th Fleet,
at AFCEA NOVA’s Naval IT Day on May 12, 2016.
Summary

18. 18 | © Copyright NetBrain® Internal Confidential
NetBrain Overview
Sample Customers
One-third of Fortune 100 enterprises are powered by NetBrain
Cool Vendor
IT Operations
Management
Best in
Network
Management
Innovations in
Network
Management
History
• Founded in 2004
• Headquartered
outside Boston, MA
with offices
worldwide
• Powering 1,600+ of
the world’s largest
customers
Awards