data security solutions @isaca lv chapter meeting 15.05.2013 siem based …
DESCRIPTION
World's #1 SIEM technology in GRC (Governance, Risk, Compliance). QRadar Risk Manager provides organizations with a pre-exploit solution that allows network security professionals to assess what risks exist during and after an attack, while also answering many "What if?" questions ahead of time, which can greatly improve operational efficiency and reduce network security risks.TRANSCRIPT
Innovations in data security
SIEM based GRC
Andris Soroka, Raivis Kalniņš,
15.05.2013
Together with
“Data Security Solutions” brief intro
Specialization – IT Security
IT Security consulting (vulnerability assessment tests, security audit, new systems integration, HR training, technical support)
Innovative & selected software / hardware & hybrid solutions from leading technology vendors from over 10 different countries
Prologue..
It doesn’t matter what framework and standard You are working with as an auditor
It doesn’t matter if You are internal or external auditor, CSO, CIO, technical or business person
Automated and real time «Security Intelligence» is what You need as mandatory for GRC –
Risk Assessment & ManagementIT Security Governance & ManagementControl of activities and environmentPerformance measurement and improvementBenefits from better alignment with business (costs saving, efficiency etc.)
AgendaIntroduction
Security Information and Events Management (SIEM)
Use cases of SIEM
SIEM based Risk Management
Q&A
Defenses in 21st Century
Around 1500 IT Security vendors for Endpoint Security
Platforms and point solutionsData Security & Encryption
DLP suites and point solutionsNetwork Security
Gateway solutionsNAC, visibility, NBAAuthentication, authorization etc.Traditional and next generation’s
Identity protectionVirtualization and cloud securityIT Security governanceOperational management & SecurityMobile Security
Today’s reality, intro..
Network and security professionals focus tends to be on preventing bad things from happening on the network
There is aleready significant amount of spending on tools designed to prevent bad things from getting in the network
When things go bad, it is because the network and security practitioner doesn’t know what they don’t know
User and System Activity
Runaway Application
Customer Transaction
Email BCC
Failed Logon
Security Breach
File Up/Download
Credit CardData Access
Information Leak
Privileges Assigned/Changed
50%?
Logs, flows, maze
What logs –Audit logsTransaction logsIntrusion logsConnection logsSystem performance recordsUser activity logsBusiness systems alerts and different other systems messages
From where - Firewalls / Intrusion
prevention Routers / SwitchesIntrusion detectionServers, desktops, mainframesBusiness applicationsDatabasesAntivirus softwareVPN’s
There is no standard format, transportation method for logs, there are more than 800 log file formats used..
Security Intelligence provides actionable and comprehensive insight for managing risks and threats from protection and detection through remediation. It could be even called as Security Mega-System.
Security Intelligence--noun 1. the real-time collection, normalization, and analytics of the
data generated by users, applications and infrastructure that impacts the IT security and risk posture of an enterprise
Move from defense to offense mode!
Plug & Play and Automated Intelligence
Analyze
Act
Monitor
Auto-discovery of log sources, applications and assetsAsset auto-groupingCentralized log mgmt.Automated configuration audits
Auto-tuning Auto-detect threatsThousands of pre-defined rules and role based reportsEasy-to-use event filteringAdvanced security analytics
Asset-based prioritizationAuto-update of threatsAuto-responseDirected remediation
One Console Security
• Turnkey log management• SME to Enterprise• Upgradeable to enterprise SIEM
• Integrated log, threat, risk & compliance mgmt.• Sophisticated event analytics• Asset profiling and flow analytics• Offense management and workflow
• Predictive threat modeling & simulation• Scalable configuration monitoring and audit• Advanced threat visualization and impact analysis
• Network analytics• Behavior and anomaly detection• Fully integrated with SIEM
• Layer 7 application monitoring• Content capture• Physical and virtual environments
SIEM
Log Management
Risk Management
Network Activity & Anomaly Detection
Network and Application
Visibility
One Console Security
Built on a Single Data Architecture
Security intelligence ..
What was the attack?
Who was responsible?
How many targets involved?
Was it successful?
Where do I find them?
Are any of them vulnerable?
How valuable are they to the business?
Where is all the evidence?
Clear & concise delivery of the most relevant information …
Q1 in action - Malware activity
IRC on port 80?QFlow enables detection of a covert channel.
Irrefutable Botnet CommunicationLayer 7 data contains botnet command and control instructions.
Potential Botnet Detected?This is as far as traditional SIEM can go.
Q1 in action - User activity monitoring
Authentication FailuresPerhaps a user who forgot their
password?
Brute Force Password Attack
Numerous failed login attempts against different user accounts.
Host CompromisedAll this followed by a successful login.
Automatically detected, no custom tuning required.
Q1 in action - complex threat detection
Sounds Nasty…But how to we know this?
The evidence is a single click away.
Buffer OverflowExploit attempt seen by
Snort
Network ScanDetected by QFlow
Targeted Host Vulnerable
Detected by Nessus
Total VisibilityConvergence of Network, Event and Vulnerability data.
Q1 in action – data loss prevention
Potential Data Loss?Who? What? Where?
Who?An internal user
What?Oracle data
Where?Gmail
SIEM Based Risk Management
SIEM Based Risk Management
Assessing the risks =Log management +Event management +Network activity monitoring +Configuration +
Most successful attacks are result of poor configurationConfiguration audits are expensive, labor intensive and time consumingConfig files are inconsistent accross the vendors and product / technology typesCompliance is mandatory in many industries
Vulnerability Assessment +VA scanners don’t prioritize based on network contextVulnerability prioritization is historically complex
SIEM Based Risk Management
SIEM Based Risk Management
SIEM Based Risk Management
SIEM Based Risk Management
SIEM Based Risk Management
SIEM Based Risk Management
SIEM Based Risk Management
SIEM Based Risk Management
SIEM Based Risk Management
SIEM Based Risk Management
SIEM is a foundation to security management in 21st Century for provides mostly the post-exploit valueRisk Manager based on SIEM gives detailed assessment of network security risk using broad risk indicators such as:
WHAT HAS HAPPENED? (from network activity data and behaviour analysis)WHAT CAN HAPPEN? (from topology and configuration)WHAT HAS BEEN ATTEPMTED? (from events and contect data)WHAT IS VULNERABLE AND AT RISK? (from scanners)
SIEM Based Risk Management Summary
Prediction & Prevention Reaction & Remediation
IBM Security Intelligence
Simulation of incidentsError & anomaly detectionAttack path visualizationCompliance automationRisk Assessment
Continuous real time auditSingle consoleIntegrated IntelligenceVizualizationHighest level of protection
SIEM Based Risk Management
Security intelligence
Predict Risk
Detect InsiderFraud
ConsolidateData Silos
ExceedRegulation Mandates
Detect ThreatsOthers Miss
IBM Security division’s vision
Think security first