hewlett packard enterprise - non-standard use …h41382.logistics / supply chain monitoring...

© Copyright 2014 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice.

Non-standard use cases for SIEM technology Matthew Schnarr Account Manager #HPProtect

© Copyright 2014 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 2

Introductions


“It’s a misnomer that HP ArcSight technology is only used for information security.”

Matthew Schnarr, Senior Pre-Sales Engineer, HP


Agenda • Investment banking • Logistics / supply chain • Senior executives • Health care

• Human resources • Corporate security • Manufacturing • Airports


Investment banking

Chinese walls – safeguard insider information Monitoring controls • Is anyone from corporate advisory communicating with my brokering department?

– Emails? – Instant Messaging? – Physical Access? – File Shares?

• Has someone from one side of a Chinese Wall just attempted to access a resource from the other side? • Has a user switch jobs between two opposite sides of a Chinese Wall had their credentials appropriately

revoked?


Logistics / supply chain

Monitoring logistics and supply chain software Monitoring controls • Satellite equipped trucks – Geospatial data

– Why did the truck stop where there was no delivery destination address? – Average speed of truck? – Which trucks are at risk of meeting delivery deadline? – Which trucks have been stopped for more then 8 hours? 24 hours?


Senior executives

Changing corporate policies SIEM solutions help by providing EVIDENCE to backup policy changes. • Changing Policy

– Senior IT, Compliance and HR Executives want changes to reduce risk. – Senior Business Executives demand no impact on their teams.

• Who typically wins? The part of the business that generates all the revenue!


Health care

Pharmaceutical control – mobile dispensary Monitoring controls • Who has been refilling inventory?

– Monitoring role based access control for role violations • Which employee has had the most wastage events?

– Statistics monitoring – Problem patient or possible theft?

• Does patient prescriptions medication dispensed align with mobile dispensart medication inventory and restocking? – Possible theft?


Health care


Human resources

Employees taking information with them after giving their notice Track what they’re doing! • PROBLEM: “Leavers” taking critical information. • SOLUTION: Automated monitoring and reporting of a “Leavers” activity (DLP Light). • CORRELATE & REPORT

– USB Logs – Printer Logs – Email Logs – Proxy Logs – Instant Messaging Logs


Corporate security

Let SIEM be the glue between it security and corporate security Corporate Security has tools IT Security should leverage! • Leverage Corporate Security’s electronic surveillance capabilities

– Cameras – Phones

• Alert Corporate Security to – Disable physical access badges – Prevent an employee from leaving (with specific items)


Manufacturing

Automated process monitoring Monitor your Manufacturing Floor Technology in Real Time • What machines are slowing down my assembly line?

– Out of material? Errors? Or are Operators moving too slow? • How much time is lost to re-tooling of a machine? • Which machinists are faster then others?

– Which produce the least amount of assembly line slow downs? – What is my efficiency per contract?


Manufacturing


Airports

Central repository for everything operational Luggage • Where is this piece of luggage right now? When was it last scanned? • Where are the bottlenecks for luggage processing? Real time? Historical?

Security • Monitor physical access to secure areas • Move security cameras to trouble areas automatically • Enable recording on cameras automatically


For more information

Attend these sessions

• PN3265 – ArcSight Customer Panel

• TB3111 – Flight of the flightless bumblebee: Use cases created because no one said we couldn’t

Visit these demos

• HP ArcSight ESM demo station

• Converged Security demo station

After the event

• Contact your sales rep • Presentations will be posted

after Protect at https://protect724.hp.com/community/events/protect-conference

Your feedback is important to us. Please take a few minutes to complete the session survey.

https://protect724.hp.com/community/events/protect-conference





Please fill out a survey. Hand it to the door monitor on your way out.

Thank you for providing your feedback, which helps us enhance content for future events.

Session TT3063 Speaker Matthew Schnarr

Please give me your feedback


Thank you

hewlett packard enterprise - non-standard use …h41382.logistics / supply chain monitoring...

Documents