The document discusses using a security data lake built on a big data platform to improve cyber defense visibility and analytics capabilities. It notes that traditional SIEM tools have limitations in scalability and openness that can be addressed using Hadoop and related big data technologies. Examples are given of how security data lakes can optimize SIEM systems by enabling greater data volumes, processing power, and analytics flexibility in a more cost effective and deployment flexible manner. The presentation concludes by describing Softnix's security data lake product and its capabilities for data collection, enrichment, analysis, search, and visualization.

1. Security Data Lake Leveraging Big Data Platform
to build stronger cyber defense
Rujirapong Ritwong
CEO, Co-founder
Softnix Technology

2. You Can’t Protect
What You Can’t See

3. IT Security need to
Visibility

4. (source : www.fbi.gov)
Unauthorized access
to data system
Data leakage / loss
72 %
(source : www.fbi.gov)

5. Way to increase your visibility

6. Definition
• Security Data Lake is Data Lake
appearing in the security field.
• Data Lake is a method of storing
data within Big Data system
• Security Data Lake central
location where all security data
• Similar Log Management, SIEM

7. Traditional Security Management
• SIEM are security monitor, log management acted as
the data store for security data.
• Technologies used 15 years ago.
• Relational databases are not well suited for large
amounts of data.
• ACID- Fast writes or fast reads, but not both
• Real time correlation (rules) engine run on single
machine.
• Not build to let other products reuse.
• Expensive for explaining

8. How long do you currently store event
and log data for SIEM
http://go.cyphort.com/rs/181-NTN-682/images/Cyphort-Ponemon-SIEM-Report.pdf
Retention data for compliance
ISO27001 , PCI-DSS, HIPAA, FISMA, Sarbanes-Oxley (SOX)

9. Unknown Events Data
Credit: Hortonworks

10. Comparing Security Data Lake to SIEM
Security Data Lake is not a replace for SIEM
Security Data Lake Objective;
◦ data storage
◦ data processing
◦ Purpose function of a SIEM covers

11. Limitation of
SIEMs
Scalability
Openness

12. Big Data Technology
Attempting solutions to the
TWO main problems of SIEMs

13. Hadoop basic

14. 2.25x
More likely
To detect threats
Within minutes
Time to detect and identify a security
incident
https://www.cloudera.com/content/dam/www/marketing/resources/analyst-reports/big-data-cybersecurity-analytics-
research-report.pdf.landing.html

15. Report user demand for
cybersecurity analytics on the rise
the past 12 months
71%
Organizations need to report

16. More information: https://www.ponemon.org/local/upload/file/Big_Data_Analytics_in_Cyber_Defense_V12.pdf
82%
Big Data Platform + Security Technologies = Stronger Cyber Defense

17. It’s still difficult to deploy Big Data cybersecurity analytics.

18. What is stopping Big Data analytics
adoption ?
https://www.cloudera.com/content/dam/www/marketing/resources/analyst-reports/big-data-cybersecurity-analytics-research-report.pdf.landing.html

19. Of organizations say it’s
impossible to leverage Big
Data analytics with
traditional system
72%
https://www.cloudera.com/content/dam/www/marketing/resources/analyst-reports/big-data-cybersecurity-analytics-research-report.pdf.landing.html

20. But Security Data Lake (Hadoop based) can.
29% 72% 43%
increase data
volumes more
than 100%
increase data
processing more
than 76%
increase data
access for
analytics more
than 100%
https://www.cloudera.com/content/dam/www/marketing/resources/analyst-reports/big-data-cybersecurity-analytics-
research-report.pdf.landing.html

21. Top Use Case
BIG DATA
Analytics

22. Use Case
Vodafone UK’s new
SIEM system relies on
Apache Flume and
Apache Kafka to
ingest nearly 1 million
events per second.

23. Open Source
Big Data for Cybersecurity
http://spot.incubator.
apache.org

24. Apache Spot

25. Open Source
Big Data for Cybersecurity
http://metron.apache
.org

26. Apache Metron

27. Data feed for Security Data Lake
Security Technologies Data Non Security Data
http://go.cyphort.com/rs/181-NTN-682/images/Cyphort-Ponemon-SIEM-Report.pdf

28. 100%
All organization use Firewall bypass Can’t monitor.
It’s Big Data.
100% 100%
DNS traffic

29. Optimize your SIEM

30. Optimize your SIEM
Split connection setup

31. Security Data lake help optimize SIEM
Cost-Effectively Increase Enterprise Visibility
Analytics Flexibility
SIEM Lock-in
Deployment Flexibility

32. Our history

33. Logger Logger Cloud
for MSP
Data PlatformAuthenticator
Logger for AWS
Logger for Azure
“Big Data Platform Company”
Collector
Edge Point
All-in-one Law Compliance Security & IT Services
Monitoring by ZABBIX
Big Data Analytics

35. Technology Partner

36. Softnix Data Platform
Big Data Analytic Platform
Any Device
Any Platform
Dashboard & VisualizeIntegration to Enterprise
Analytic System
Softnix Data Platform
Big Data Analytic Platform

37. Solution of Softnix Data Platform

38. Architecture Softnix Data Platform
Softnix Data Platform Architecture

39. Capability
üSupport machine data with any type
üData extraction to analytic format
üSupport data indexing and aggregation
üFull-text search or specific search
üVisualize data for human understand
üSchedule send report to email

40. Our Process
Collection of
Data
Data
Enrichment
Convert into
Structured
Analysis of
Data
Virtualization
of Data

41. Dashboard System

42. Full-Text Search & Specific search
Event Detection
Data Extraction
Visualize data

43. Simple Data Visualization

44. Data Aggregation

45. Use Case:
Security Dashboard

47. Use Case:
Authentication Monitor

48. Use Case:
DNS Dashboard

49. Use Case:
Cloud Firewall for MSP

50. Multiple dashboard per project

51. Contact Us
www.softnix.co.th
facebook.com/softnixtech
twitter.com/softnix
medium.com/@softnix
info@softnix.co.th