Symantec Webinar: What Cyber Threats Are Lurking in Your Network?
•
0 likes•251 views
The document discusses the benefits of network forensics and security analytics solutions. It describes how an online gaming company struggled to determine if they were breached due to lacking network visibility. It then outlines how security analytics can provide complete network visibility by passively capturing all network traffic and enriching it with threat intelligence to help speed incident detection and response. The document advocates that organizations should retain at least 30 days of network traffic data for investigations. It also describes how security analytics works and the different deployment options available. Real customer examples are then provided where advanced threat assessments uncovered security issues and helped customers strengthen their security posture.
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Symantec Webinar: What Cyber Threats Are Lurking in Your Network?
Similar to Symantec Webinar: What Cyber Threats Are Lurking in Your Network? (20)
More from Symantec
More from Symantec (20)
Recently uploaded
Recently uploaded (20)
Symantec Webinar: What Cyber Threats Are Lurking in Your Network?
- 1. What’s Lurking in Your Network? Complete Security Visibility = Peace of Mind Alan Hall, Symantec Andre Engel, Symantec
- 2. Copyright © 2019 Symantec Corporation SYMANTEC PROPRIETARY– Limited Use Only 2 Online Gaming Company in Chaos The Need for Network Forensics – Painful Story Had no way to confirm or deny… Concerns about brand and reputational impact… People and big $ thrown at the problem… Informed we may be the victim of a breach “Why can’t you prove if this happened or not”… Urgent, high-priority project spun up…
- 3. Copyright © 2019 Symantec Corporation SYMANTEC PROPRIETARY– Limited Use Only 3 Cannot Quickly Detect or Accurately Assess Impact of an Incident The “Average” Enterprise TODAY’S REALITY RESOLUTION INCIDENT IDENTIFIED TIME TO DETECTION 206DAYS* TIME TO RESPONSE 21-35DAYS* *Verizon Data Breach Investigations Report BREACH ** Ponemon: https://www.ponemon.org/ • Damage occurring for nearly 7 months before detection • …and is not resolved for another month after identified Average Breach Cost - $3.8M **
- 4. Copyright © 2019 Symantec Corporation SYMANTEC PROPRIETARY– Limited Use Only 4 Complete Answers for Focused Resolution Security Analytics Security Analytics – System of Record Security Analytics doesn’t disrupt the Networking/IT department Records all traffic – 24/7 lossless packet capture (header and payload) – Days/weeks/months Massive Intelligence – Enriches with Symantec and 3rd party threat and reputation data Reconstructs All Evidence – Artifacts, flows, files, and activity in human-readable form At a minimum, organizations should capture 30 days’ of packet data. 60 days’ worth is even better.”
- 5. Copyright © 2019 Symantec Corporation SYMANTEC PROPRIETARY– Limited Use Only 5 Security Analytics – How It Works Security Analytics sits passively off the network (SSLV orTAP)1 1 2 Captures all network traffic(packet header/payload)2 Taps GIN andoutside threat intelligence to enrichpacket data3 Unknownfiles sent to Content Analysis/3rd party to Sandbox4 Alerts fromSAorother tools may trigger aninvestigation5 Incident response teamfinds source/scope ofattack,resolves6 3 SA CA sandbox GIN + 3rd Party Reputation 4 6 5 SSLV/TAP SEPM
- 6. Copyright © 2019 Symantec Corporation SYMANTEC PROPRIETARY– Limited Use Only 6 Security Analytics Virtual Appliance Total networkvisibility Absolute flexibility Security Analytics Appliances Comprehensive,pre-configured appliances (speed+storage options) Security Analytics Components Manage multiple appliances/VMs Security Analytics Central Manager Scale to any retention requirementwith high-densitystorage options Security Analytics Storage Modules Direct-attached and SAN • Forensics for network and cloud workloads • Full visibility • Dynamic scaling • Additional platforms coming
- 7. Copyright © 2019 Symantec Corporation SYMANTEC PROPRIETARY– Limited Use Only 7 Real-time MSS Incident Triage and Validation Symantec Managed Network Forensics MSS Analysis Team Validate,Classify, Prioritize,Escalate Endpoint Firewall Proxy IDS/IPS Data Collection 1 MSS Analytics 2 Incident Handling 3 MSS Analytics Engine Transforms logdata into security events Applies intelligence / business context Intelligence BusinessContext Cloud SymantecManagedNetworkForensics* • MSS SOC TechnologyPlatform identifiesa suspicious event defined bySYMC Intel • MSS Analyst uses customer’sSymantec Security Analytics to perform Tier 1 triage • MSS Analyst updates incident severity accordingly • (Optionally)MSSengages IR team for rapid response Server Symantec Security Analytics *Customer mustalso own Security Analytics MSS SOC Technology Platform Advanced analytics Machine learning
- 8. Advanced Threat Assessment Complete Visibility – Uncovering What’s Really on your Network
- 9. Copyright © 2019 Symantec Corporation SYMANTEC PROPRIETARY– Limited Use Only 9 Advanced Threat Assessment (ATA) What is it? • Security Analytics records your network data • Results are analyzed to identify attacks, possible threats, and gaps • Think of it as PoC Light…It’s like a Black Box Recorder…and it’s FREE. Why? • Real visibilityinto your network and security posture • Reveals key issues – It’s not a demo, it’s your data! • You can prioritizes your security initiatives ATA = Complete Visibility and Peace of Mind
- 10. Copyright © 2019 Symantec Corporation SYMANTEC PROPRIETARY– Limited Use Only 10 Easy Process to Gain Visibility into Your Security Posture Free Advanced Threat Assessment Deploy Drop Security Analytics into your network Record Record Traffic: for a week Push Push Button: Generate Risk and Visibility Report Review Review report and uncover areas to improve security ~ 1-3 Weeksto completedepending onlevelof detail Fortify Address issues and fortify security
- 11. Risk & Visibility Report
- 12. Copyright © 2019 Symantec Corporation SYMANTEC PROPRIETARY– Limited Use Only 12 Custom assessment report in minutes Risk & Visibility Report
- 13. Copyright © 2019 Symantec Corporation SYMANTEC PROPRIETARY– Limited Use Only 13 Push Button – See Results! Risk and Visibility Report Analyzes captured network traffic View what’s on your network Creates reports for: • Malicious files • Alerts • SSL traffic • Risky applications • Anomalies • …more Generates executive summary Close security gaps!
- 14. Copyright © 2019 Symantec Corporation SYMANTEC PROPRIETARY– Limited Use Only 14 The Power of an ATA UNKNOWN FILES? Focus onDeeper Inspection, sandbox,Isolation 136.74K unknown/unrated files not scanned for novel threats and zero-daymalware HIGH RISK TRAFFIC? Look into CASB solution 1.11K Malicious URLs detected by WRS HIGH ENCRYPTED TRAFFIC? Decrypt traffic for full visibility MALICIOUS AND UNCATEGORIZED URLS? Look into WebIsolation 86.77 GB High Risk Traffic Potential riskofdata loss or policy compliance issues 50.98%Encrypted Traffic 30.98KPredicted Files Hidden in Encrypted Traffic
- 15. Real Examples Andre Engel, Symantec
- 16. Copyright © 2019 Symantec Corporation SYMANTEC PROPRIETARY– Limited Use Only 16 Security Analytics in Cyber Security Exercise
- 17. Copyright © 2019 Symantec Corporation SYMANTEC PROPRIETARY– Limited Use Only 17 Part of the German blue team in Locked Shields 2019
- 18. Copyright © 2019 Symantec Corporation SYMANTEC PROPRIETARY– Limited Use Only 18 Ever played with the best team in the world?
- 19. Copyright © 2019 Symantec Corporation SYMANTEC PROPRIETARY– Limited Use Only 19 Adding Value to Any Industry Advanced Threat Assessment
- 20. Copyright © 2019 Symantec Corporation SYMANTEC PROPRIETARY– Limited Use Only 20 Customer • 2,400 retail stores / 19 countries / Sales – 2.4B Euros • Customer is looking into Cyber Insurance ATA Findings • Identified breaches, phishing attacks, active botnets compromised systems, unsecure communications, etc. • Symantec a strategic security partner! • Solution: • Incident Response Service • SymantecEndpoint Protection • SymantecEmail.cloud Lower cost of customer’s cyber insurance “The ATA helped us know our true security posture.” ATA Changes the Game Advanced Threat Assessment Helps Secure Retail Giant ATA: European Retail Giant ATA Details • Deployed SA and captured traffic for three weeks • Reviewed Risk & Visibility report / Presented findings ATA Lead to Incident Response Team Engagement • Symantec IR Team engaged to verify criminal misusage and possible lateral movement
- 21. Copyright © 2019 Symantec Corporation SYMANTEC PROPRIETARY– Limited Use Only 21 Assessment key findings 51.28Munknown/unrated files not scanned for novel threats and zero-daymalware 18.34KMalicious URLs detected by WRS 3.75 TBHigh Risk Traffic Potential riskofdata loss or policy compliance issues 32.75%Encrypted Traffic 183.95KPredicted Files Hidden in Encrypted Traffic
- 22. Copyright © 2019 Symantec Corporation SYMANTEC PROPRIETARY– Limited Use Only 22 Customer • International Science and Technology Graduate School • Over half faculty and staff recruited outside of country • Concerned with outside and internal threats • Use SIEM, but limited staff for many alerts – crossing fingers ATA Findings • Suspicious behavior, P2P communications, Risky sites, 50% encrypted traffic • Not aware of security issues without the ATA – Serious attention • Changed their focus and narrowed their attention to high-priority issues • Solution: • Network Forensics- “look back” • SSLdecryption for visibility • Malware and sandbox inspection • Cloud Security Services • Threat Intelligence / Reputation Services • Email security with training • Email and Web Isolation • Confidence in strengthened security ATA Changes the Game Assessment Strengthens University’sSecurity ATA: APAC Higher Education ATA Details (Driven by APAC Team) • CISO wanted to see actual threats through ATA • Recorded for one month/Shared Risk & Visibility Report
- 23. Copyright © 2019 Symantec Corporation SYMANTEC PROPRIETARY– Limited Use Only 2323 Compliance violation and shadow IT 228.46 GB High Risk Traffic Potential risk of data loss or policy compliance issues Encrypted traffic 49.05% Encrypted Traffic 5.22K Predicted Files Hidden in Encrypted Traffic Unknown/Unrated files 3.06M unknown/unrated files not scanned for novel threats and zero-day malware Web access to malnet 3.74K Malicious URLs 1.28M Malicious Files Found Assessment key findings
- 24. Copyright © 2019 Symantec Corporation SYMANTEC PROPRIETARY– Limited Use Only 24 Differentiated Solution Symantec Security Analytics 1 2 3 Incident Response Focus Full packet capture for IR, not network ops Metadata Data enrichment for swift access and root cause discovery Integrations Adding critical context to security tools
- 25. Copyright © 2019 Symantec Corporation SYMANTEC PROPRIETARY– Limited Use Only 25 Next Steps • Check out Security Analytics • Sample Risk & Visibility Report • Register for an ATA go.symantec.com/ata
- 26. QA
- 27. Thank You