Are you prepared for a data breach? Are you confident you will find a breach in a timely manner? Facts are over 70% of businesses report a security breach and 75% of breaches are undetected for days or even months. Once discovered, incident response teams are under extreme pressure to close the breach, figure out what happened, what was lost, and calculate the risk. Organizations need a sophisticated incident response plan. View this presentation and learn how to: - Discover sensitive data, risk, and vulnerabilities - Detect and block cyber security events - Investigate incidents and automate remediation - Demonstrate consistent policy application across all sensitive data

1. © 2015 Imperva, Inc. All rights reserved.
Sophisticated Incident Response
Requires Sophisticated Activity
Monitoring
Mike Sanders, Principal SE and Team Lead, Imperva
Bryan Orme, Principal, GuidePoint Security
July 29, 2015

2. © 2015 Imperva, Inc. All rights reserved.
Speakers
2
Bryan Orme
Principal, GuidePoint Security
Mike Sanders
Principal SE and Team Lead, Imperva

3. 3
“There are two kinds of companies in the world: those that know they’ve
been hacked, and those that have been hacked and don’t yet know it.”
– Every Quotable Security Professional

4. © 2015 Imperva, Inc. All rights reserved.
Agenda
4
1. Need for an audit solution
2. Incident response point of view
3. Log collection is key
4. Compliance and log retention time
5. Think without a box

5. © 2015 Imperva, Inc. All rights reserved.
Need for an audit solution
Collecting the needles and the haystack
1
5

6. © 2015 Imperva, Inc. All rights reserved.
Audit tips
6
1. Have a good plan
2. Know the data
3. Start with your results in mind
4. Use a global platform
5. Audit what matters
6. Don’t audit what doesn’t matter
7. Don’t forget YOUR data
8. Constantly think security
9. Make sure it all works
10. Look to the future
Top
10
Tips

7. © 2015 Imperva, Inc. All rights reserved.
Making audit work for you and your IR team
7
• Central repository
• What to collect and what not to collect
• Test it all out

8. © 2015 Imperva, Inc. All rights reserved.
Central repository
8
• Global platform across multiple DB vendors
• Long-term data retention
• Varying degrees of verbosity

9. © 2015 Imperva, Inc. All rights reserved.
What to collect and what not to collect
• You need the needles and the haystack
– You don’t know what you don’t know prior to an incident
• Abnormal behavior is key
• Don’t leave out secondary data
– Employee data (PII)
– Intellectual property
9

10. © 2015 Imperva, Inc. All rights reserved.
Test it all out
• Test high availability / disaster recovery
• Validate access to archive data
• Run sample investigation reports
10

11. © 2015 Imperva, Inc. All rights reserved.
Incident response point of view
Trail of needles in field of haystacks
2
11

12. © 2015 Imperva, Inc. All rights reserved.
Incident response point of view
• Logs are crucial to the incident response investigation
• When incident response team is called
– APT has infiltrated the network infrastructure for 6+ months
• Commonly APT will gain access via service provider or contractor
– Agreements with service providers, contractors, and such should include language to
collect logs upon request.
• Common log sources beneficial to incident response
– Web, proxies, IDS, IPS, database, firewall (outgoing)
• http://www.imperva.com/Products/DatabaseFirewall
12

13. © 2015 Imperva, Inc. All rights reserved.
Incident response point of view
• Incident response goal
– Investigation
– Story / background
– Systems impacted
– Containment
• Prevent further damage
– Remediation
• Correcting related
vulnerabilities
– Data analysis – quantify data
loss
– Litigation support
13
Incident Story
Systems Impacted
Quantify Data Loss
Identify APT
Litigation Support

14. © 2015 Imperva, Inc. All rights reserved.
Collection is key
Focus initial resources on collection over correlation
3
14

15. © 2015 Imperva, Inc. All rights reserved.
Log collection and retention is key
• Focus budget on log collection and retention first
– Secondary feed correlation as next step (SIEM integration)
• Advantages of extensive log collection
– Increases probability of detecting APT early
– Increased probability of defining (detailing / identify) specific data loss
– Increased probability of identifying APT for restitution purposes
• Disadvantage
– Resource intensive / expensive
15

16. © 2015 Imperva, Inc. All rights reserved.
Log collection and retention is key
16
• Web applications
• Directory Services manipulation
• Lateral movement in infrastructure
• Database attacks
• Backdoors and malware
• Lack of logs hinder investigation, or prevent detection
– Collect as much as possible

17. © 2015 Imperva, Inc. All rights reserved.
Log collection and retention is key
• Start with collecting logs to a central location
– Global platform for all database vendors
– Track abnormal behavior
• As team and functionality grows
– Incorporate log correlation / SIEM
– Gain better insight into audit logs
17

18. © 2015 Imperva, Inc. All rights reserved.
Compliance and log retention time
3 months immediately available with 6 months capable
9 months archived
4
18

19. © 2015 Imperva, Inc. All rights reserved.
Compliance and log retention time
• Most compliance vague in log retention time
– NIST Cyber Security Framework
– NIST 800-92
– ISO 27001:2013 A.12.4
– HIPAA ...
• Incident response tends to align with PCI DSS
– Minimum 3 months immediately available
– Minimum 9 months archived
• Consider capability of 6 months immediately available, but use only 3 months
– Provides buffer to retain all logs during investigation
– Increases probability of recovering deleted logs
19

20. © 2015 Imperva, Inc. All rights reserved.
Think without a box
5
20

21. © 2015 Imperva, Inc. All rights reserved.
Think without a box
21
• Instead of thinking outside the box think without a box
• Don’t limit your logging data because you think it is not
needed
– Dynamic nature of Information Security results in unknown attack
vectors
– Non-security log sources are important too (System, PowerShell, and
Application logs provide evidence of lateral movement)
• Minimum Retention
– 3 months immediately available logs with capacity of 6 months
– 9 months archived logs

22. © 2015 Imperva, Inc. All rights reserved.
Imperva
+1(866) 926-4678 – Americas
+44 01189 497 130 – EMEA
info@imperva.com
GuidePoint Security
+1(877) 889-0132
info@guidepointsecurity.com
22

23. 23