cyberbit gmbh münchen - infinigate deutschland gmbh · malware prevention |prevent known and...

copy 2018 by CYBERBIT CYBERBIT Proprietary

Cyberbit GmbH

Muumlnchen

1

Tilman Epha

Sales Director DACH

copy 2018 by CYBERBIT CYBERBIT Proprietary 2

Gegruumlndet 2015

Gehoumlrt zu Elbit Systems (NASDAQ

ESLT)

Gepruumlfte Qualitaumlt Unter haumlrtesten

Bedingungen erprobt

Beschaumlftigte 240

Globale Praumlsenz Niederlassungen in

den USA Europa und Asien

Overview

copy 2018 by Cyberbit Cyberbit Proprietary 3

Cyberbit Endpoint Protection

copy 2018 by Cyberbit Cyberbit Proprietary

ldquoThe most critical EDR capability is the ability to detect sophisticated hidden threats ideally

without requiring externally fed IOCsrdquo

Gartner 2017

Market Guide for Endpoint Detection and Response Solutions

4


But the Industry is Far From Achieving This Goal

5

ldquohelliptheir product missed

numerous attacksrdquo

NSS Labs Blog Crowdstrike Falcon Testing

March 2017

Failing 3rd party testing

Sharing customer data with 3rd parties

Exploited and used as attack vectors


Chosen by the Israeli

government as the

exclusive endpoint

protection platform

2011 2012 2013 2014 2015 2016 2017 2018

Goes out of stealth

made available to

the commercial

market

Anti-

ransomware

engine

released

Successfully prevents

WannaCry Petya and

BadRabbit out-of-the-

box

First MSSP

rollout

Forged in the toughest environments on the globe

6

copy 2018 by Cyberbit Cyberbit Proprietary 7 EDR Malware Prevention Anti-Ransomware

bull Kernel-Level Recording

bull Big-Data Storage

bull 1-Click VisibilityForensics

bull Behavioral Detection

bull Machine Learning

bull Non-MalwareFileless

EDR |Visibility and detection of unknown threats

Forensics Hunting

and Containment

Detection amp

Analysis Engine

Analysis


bull 1-Click Containment

bull Proactive Hunting

bull Anti-Tampering

EDR |Centralized Hunting and Containment

Forensics Hunting

and Containment

Detection amp

Analysis Engine

Analysis


Malware Prevention |Prevent known and unknown threats

9 EDR Malware Prevention Anti-Ransomware

bull Block pre-execution

bull Static analysis

bull Known threats - CVEs

bull Unknown (signature-

less) threats ndash IoCs

bull 3 components One

installation



bull DeceptionDecoys

bull Known and unknown

ransomware

bull Detect propagation eg

WannaCry

bull Automated remediation

Anti-Ransomware |Block Known amp Unknown


Security Monitoring und Angriffspraumlvention

in Industrieumgebungen

11


Die Herausforderung SCADA Netzwerke sind haumlufig ungeschuumltzt

Insecure ldquoby designrdquo ndash

ICS sind auf Hochverfuumlgbarkeit ausgelegt nicht auf Sicherheit

bull Flache Architektur

bull Keine Authentifizierung

bull Selten aktualisiert

Breite Vernetzung ndash

Moderne ICS werden immer komplexer und vernetzt mit der ldquoaumluszligeren Weltrdquo

bull Fernzugriff

bull Verschmelzung von ITOT

bull IIoTIndustrie 40

Fehlende Sichtbarkeit ndash

Assets Befehls- und Kommunikationsstruktur

bull Multi-Hersteller Umgebungen

bull Schichtweiser Aufbau uumlber

viele Jahre hinweg

bull Fehlende Uumlberwachung der

OT


SCADA Netzwerke stehen unter hohem Risiko

Enterprise

Power Generation Facility 1 Transformation Substation 1 Transformation Substation N

Boilers Turbines Generatorhellip

Engineering station HMI stations SCADA servers Historian

switch

Operator work station

Infected

PLC Logic

FW

Infected

USB Keys

Insecure

Remote Support

SIEM ERP ERP

Insecure

Serial Links

Insecure

Modems

Insecure

WirelessInfected

Laptop

Transformers Switches Circuit breakersSwitchesTransformers Circuit breakers

Internet firewall

OPC server

firewall

RTUsPLC

s

RTUsPLC

s

RTUsPLC

s


Beispiel Stromerzeugung

Angreifer aumlndert Sollwert von Kontrollwerten innerhalb einer Dampfturbine

Techniker aktualisiert die PLC Firmware waumlhrend Wartungsarbeiten und laumlsst die PLC ID auf dem Standardwert

Angreifer aumlndert die Zieltemperatur von einem Dampfkessel PLC

Kaum uumlberwacht und einfacher Zugriff auf kritische Infrastruktur kann groszlige Schaumlden verursachen

Beispiel Uumlbertragungsnetzwerke

Techniker laumldt fehlerhalte Logik auf RTU was zu einer Aumlnderung der Schalterzustaumlnde fuumlhrt

Malware infiziert die Engineering-Workstation und nutzt eine bekannte Schwachstelle einer Transformer-PLC um die Logik von dieser zu modifizieren

Angreifer schickt Befehle um Schalter zu oumlffnen


Erkennung von boumlsartigen Aktivitaumlten im Netzwerk

Enterprise




switch


Infected

PLC Logic

FW

Infected

USB Keys

Insecure

Remote Support

SIEM ERP ERP

Insecure

Serial Links

Insecure

Modems

Insecure

WirelessInfected

Laptop


Internet firewall

OPC server

firewall

RTUsPLC

s

RTUsPLC

s

RTUsPLC

s

ManagementIndustrial Protection

Platform

Network Sensor

Field IDS

Span P

ort


Umfangreiche Hersteller und Protokoll Unterstuumltzung wird benoumltigt

bull CLNP

bull COTP

bull DCE RPC

bull ENIP

bull EtherNetIP

bull IEEE 8023

bull LLC

bull Ethercat

Hersteller

bull BACNET

bull BVLC

bull CIP

bull CIPCLS

bull CIPCM

bull DNP3

bull MDLC

bull MMS

bull ModbusTCP

bull OMRON-FINS

bull Profibus

bull Profinet CM

bull Profinet DCP

bull Profinet IO

bull Profinet PTCP

bull S7Comm

bull S7Comm Plus

bull SITA

bull SyncPhasor

bull Teleperm XP

bull TIM

bull SNMP

bull SSH

bull SSL

bull ARP

bull Und viele mehrhellip

Protokolle

bull Goose

bull IEC 60870-5

bull IEC 61850 IEC101

bull IEC104

bull Kingfisher

bull Serial Modbus

bull NTP

bull HTTP

bull FTP

Incident Response PlatformSOC3

D

Introducing

SOC3D

InvestigateAutomateOrchestrate

YOUR SOC HUB RESPONS

E TOOLS

Memory Dump

ALERTS

SOC 3D

Big-Data

ENRICHMENT

Firewall

IPS

WAF

Active Directory

IT S

YS

TE

MS

OT

AN

D I

OT

SY

ST

EM

S

CMDB

Threat Intel

Logs OS

Service Application

Network Devices

GRC

HR Systems

Compliance

Vulnerability Assessment

SIEM

IoT Security

Physical Access

Control

OT Security

EDR

UEBA

Helpdesk

CRM

Email

Ticketing

MULTIPLE INTEGRATIONS RESPONS

E

ALERTS

SOC 3D

ENRICHMENT

Remedy

Database Query

EDR

SCADAShield

Threat

Intelligence

File AnalysisIAM

MALWARE INCIDENT WORKFLOW TRADITIONAL SOC

SIEM

New

Malware

Alert

5 minutes 5 minutes 5 minutes 5 minutes

Critical

Process

Alert CISO

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Check Asset

Criticality

Check CISO

ContactEscalate

to Tier 2

Investigate

Collect

Additional

Raw Data

Send recommendations

and Summary report

Run Memory

Dump Utility

5 minutes5 minutes

5 minutes


Manual Preparation Time 35

minutes

SIEM

New

Malware

Alert


Critical

Process

Alert CISO

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Check Asset

Criticality

Check CISO

ContactEscalate

to Tier 2

Investigate

Collect

Additional

Raw Data


and Summary report

Run Memory

Dump Utility

5 minutes5 minutes

5 minutes

MALWARE INCIDENT WORKFLOW WITH SOC3D AUTOMATION

SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

ContactAlert CISO


SIEM


and Summary report

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

Contact

Automated

Response

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility

Alert CISO


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Automated

Decision Making

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

Investigate

Check CISO

ContactAlert CISO

Automated

Response

Collect

Additional

Raw Data

Start Here


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Automated

Decision Making

Automated Data

Enrichment

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

ContactAlert CISO

Automated

Response

THE IMPACT OF SOC3D AUTOMATIONON MTTR AND TCO

Average number of stages per incident

Average time saved per stage

Total time savedper incident

Number of significant

incidentsday

10 incidents

$600

5 minutes7 stages

Resulting TCO saving

per year

TCO savingper day

Analyst time saved per day

35 minutes

$2190006 Hours

Free analysts time to recapture incidents


28

Cyberbit Range


29

Training Cybersecurity Teams

Like Fighter Pilots

Weltweit fuumlhrende Platform fuumlr Cyber-Simulationen


Mehr als eine Million Cyber-Security Stellen sind weltweit nicht besetzt

200000Stellen alleine in den USA

Der Cyber-Security Arbeitskraumlftemangel

wird voraussichtlich

Weniger als 30der Analysten haben einen

Ransomware Incident erlebt

Weniger als 20

der Analysten haben einen Security

Incident erlebt welcher zur

Unterbrechung eines kritischen

Business Prozesses gefuumlhrt hat


Breach von sensitiven Daten

erlebt

Unternehmen koumlnnen offene Stellen nicht besetzen

Die moisten Mitarbeiter haben noch keinem echten Angriff beigewohnt

Forbes Magazine 2016 Through the Eyes of Cyber Security Professionals Annual Research Report ESG amp ISSA Dec 2016

Die Herausforderung Die unvorbereiteten Security Operation

bis 2019 weltweit betragen

6 Millionen unbesetzte Positionen


Simulations-

netzwerke verwaltenSimulierte

Szenarien waumlhlen

Waumlhrend der

Laufzeit Sichtbarkeit

und Veraumlnderbarkeit

der Simulation in

Echtzeit

De-Brief

Untersuchung der

Simulations-

ergebnisse

1 2 3 4

Ein komplettes Simulations-Management-System


Beispielszenario ndash DB Dump via FTP Exploit

Schwierigkeitsgrad

Voraussichtliche Dauer

Art

Erforderliche Faumlhigkeiten

Linux Log Management

FTP Server Management

MSSQL Server Management

Checkpoint Firewall

ArcSight

Hard

4 Hrs

Blue Team

Ziele des Szenarios

bull ldquoHands onrdquo Erfahrungen mit einem ldquoData Leakagerdquo-Event

bull Praktische Uumlbungen zu den Themen ldquoLinux Loggingrdquo ldquoMSSQL Server Logging

Researchrdquo und ldquoBasic Forensicsrdquo

bull ldquoHands onrdquo Erfahrungen mit FTP Servern und Linux Management Werkzeugen

Actions taken by the attacker

to obscure the attack

FTP Exploit

Ping Sweep

SSH Tunneling

DB Authentication Brute Force

Extract DB Data

Port Scanning


34

Training Classroom 1

Scenario Emulator

Instructor Room



Preisbeispiele

SCADAShield

Lizenzierung Die Lizenz basiert auf ldquoPackets per Second (PPS)rdquo ein Wert welcher die Bandbreite fuumlr die SCADAShield Installation beschreibt

Beispiel 1 (kleines Unternehmen) 3000 PPS = 30000 euro (jaumlhrlich nur Lizenz inklusive Support)

Beispiel 2 (groszliges Unternehmen) 20000 PPS = 176000 euro (jaumlhrlich nur Lizenz inklusive Support)

Disclaimer Die obigen Annahmen basieren auf einer Schaumltzung und einem bereits inkludierten Projektdiscount Die tatsaumlchlich benoumltigte Bandbreite (PPS) kann je nach Unternehmen

abweichen und muss individuell ermittelt werden Diese Preisinformation stellt kein verbindliches Angebot dar

SOC 3D

Lizenzierung Die Lizenz basiert auf der Anzahl der SOC Operators Dabei wird die Anzahl der gleichzeitig genutzten Operatoraccounts lizenziert

Beispiel Enhanced Package (5 Operators 30 Out-of-the-Box Workflows 10 Dashboards) 64500 euro (jaumlhrlich Hardware + Software inklusive Support)

Disclaimer Die obigen Annahmen basieren auf einem typischen Kunden Diese Preisinformation stellt kein verbindliches Angebot dar

EDR

Lizenzierung Die Lizenz basiert auf der Anzahl der zu uumlberwachenden Endpoints Dabei wird zwischen Desktop (z B Windows 710) und Server (z B Windows 20122016) Betriebssystemen

unterschieden

Beispiel 5001 Endpoints (Desktop) 117000 euro (jaumlhrlich nur Lizenz inklusive Support)

Disclaimer Die obigen Annahmen basieren auf einem typischen Kunden Es gibt weitere Faktoren welche die Kosten beeinflussen koumlnnen Diese Preisinformation stellt kein verbindliches

Angebot dar


Vielen Dank


Gegruumlndet 2015

Gehoumlrt zu Elbit Systems (NASDAQ

ESLT)

Gepruumlfte Qualitaumlt Unter haumlrtesten

Bedingungen erprobt

Beschaumlftigte 240

Globale Praumlsenz Niederlassungen in

den USA Europa und Asien

Overview






Gartner 2017


4



5




March 2017






government as the

exclusive endpoint

protection platform

2011 2012 2013 2014 2015 2016 2017 2018

Goes out of stealth

made available to

the commercial

market

Anti-

ransomware

engine

released


WannaCry Petya and


box

First MSSP

rollout


6









Forensics Hunting

and Containment

Detection amp

Analysis Engine

Analysis




bull Anti-Tampering


Forensics Hunting

and Containment

Detection amp

Analysis Engine

Analysis










installation





ransomware


WannaCry






11










bull Fernzugriff







viele Jahre hinweg


OT



Enterprise




switch


Infected

PLC Logic

FW

Infected

USB Keys

Insecure

Remote Support

SIEM ERP ERP

Insecure

Serial Links

Insecure

Modems

Insecure

WirelessInfected

Laptop


Internet firewall

OPC server

firewall

RTUsPLC

s

RTUsPLC

s

RTUsPLC

s













Enterprise




switch


Infected

PLC Logic

FW

Infected

USB Keys

Insecure

Remote Support

SIEM ERP ERP

Insecure

Serial Links

Insecure

Modems

Insecure

WirelessInfected

Laptop


Internet firewall

OPC server

firewall

RTUsPLC

s

RTUsPLC

s

RTUsPLC

s


Platform

Network Sensor

Field IDS

Span P

ort



bull CLNP

bull COTP

bull DCE RPC

bull ENIP

bull EtherNetIP

bull IEEE 8023

bull LLC

bull Ethercat

Hersteller

bull BACNET

bull BVLC

bull CIP

bull CIPCLS

bull CIPCM

bull DNP3

bull MDLC

bull MMS

bull ModbusTCP

bull OMRON-FINS

bull Profibus

bull Profinet CM

bull Profinet DCP

bull Profinet IO

bull Profinet PTCP

bull S7Comm

bull S7Comm Plus

bull SITA

bull SyncPhasor

bull Teleperm XP

bull TIM

bull SNMP

bull SSH

bull SSL

bull ARP


Protokolle

bull Goose

bull IEC 60870-5


bull IEC104

bull Kingfisher

bull Serial Modbus

bull NTP

bull HTTP

bull FTP


D

Introducing

SOC3D



E TOOLS

Memory Dump

ALERTS

SOC 3D

Big-Data

ENRICHMENT

Firewall

IPS

WAF

Active Directory

IT S

YS

TE

MS

OT

AN

D I

OT

SY

ST

EM

S

CMDB

Threat Intel

Logs OS

Service Application

Network Devices

GRC

HR Systems

Compliance


SIEM

IoT Security

Physical Access

Control

OT Security

EDR

UEBA

Helpdesk

CRM

Email

Ticketing


E

ALERTS

SOC 3D

ENRICHMENT

Remedy

Database Query

EDR

SCADAShield

Threat

Intelligence

File AnalysisIAM


SIEM

New

Malware

Alert


Critical

Process

Alert CISO

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Check Asset

Criticality

Check CISO

ContactEscalate

to Tier 2

Investigate

Collect

Additional

Raw Data


and Summary report

Run Memory

Dump Utility

5 minutes5 minutes

5 minutes



minutes

SIEM

New

Malware

Alert


Critical

Process

Alert CISO

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Check Asset

Criticality

Check CISO

ContactEscalate

to Tier 2

Investigate

Collect

Additional

Raw Data


and Summary report

Run Memory

Dump Utility

5 minutes5 minutes

5 minutes


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

ContactAlert CISO


SIEM


and Summary report

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

Contact

Automated

Response

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility

Alert CISO


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Automated

Decision Making

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

Investigate

Check CISO

ContactAlert CISO

Automated

Response

Collect

Additional

Raw Data

Start Here


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Automated

Decision Making

Automated Data

Enrichment

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

ContactAlert CISO

Automated

Response






incidentsday

10 incidents

$600

5 minutes7 stages


per year

TCO savingper day


35 minutes

$2190006 Hours



28

Cyberbit Range


29


Like Fighter Pilots









Weniger als 20







erlebt








Simulations-


Szenarien waumlhlen

Waumlhrend der



der Simulation in

Echtzeit

De-Brief

Untersuchung der

Simulations-

ergebnisse

1 2 3 4




Schwierigkeitsgrad


Art





Checkpoint Firewall

ArcSight

Hard

4 Hrs

Blue Team

Ziele des Szenarios







FTP Exploit

Ping Sweep

SSH Tunneling


Extract DB Data

Port Scanning


34


Scenario Emulator

Instructor Room



Preisbeispiele

SCADAShield






SOC 3D




EDR


unterschieden



Angebot dar


Vielen Dank






Gartner 2017


4



5




March 2017






government as the

exclusive endpoint

protection platform

2011 2012 2013 2014 2015 2016 2017 2018

Goes out of stealth

made available to

the commercial

market

Anti-

ransomware

engine

released


WannaCry Petya and


box

First MSSP

rollout


6









Forensics Hunting

and Containment

Detection amp

Analysis Engine

Analysis




bull Anti-Tampering


Forensics Hunting

and Containment

Detection amp

Analysis Engine

Analysis










installation





ransomware


WannaCry






11










bull Fernzugriff







viele Jahre hinweg


OT



Enterprise




switch


Infected

PLC Logic

FW

Infected

USB Keys

Insecure

Remote Support

SIEM ERP ERP

Insecure

Serial Links

Insecure

Modems

Insecure

WirelessInfected

Laptop


Internet firewall

OPC server

firewall

RTUsPLC

s

RTUsPLC

s

RTUsPLC

s













Enterprise




switch


Infected

PLC Logic

FW

Infected

USB Keys

Insecure

Remote Support

SIEM ERP ERP

Insecure

Serial Links

Insecure

Modems

Insecure

WirelessInfected

Laptop


Internet firewall

OPC server

firewall

RTUsPLC

s

RTUsPLC

s

RTUsPLC

s


Platform

Network Sensor

Field IDS

Span P

ort



bull CLNP

bull COTP

bull DCE RPC

bull ENIP

bull EtherNetIP

bull IEEE 8023

bull LLC

bull Ethercat

Hersteller

bull BACNET

bull BVLC

bull CIP

bull CIPCLS

bull CIPCM

bull DNP3

bull MDLC

bull MMS

bull ModbusTCP

bull OMRON-FINS

bull Profibus

bull Profinet CM

bull Profinet DCP

bull Profinet IO

bull Profinet PTCP

bull S7Comm

bull S7Comm Plus

bull SITA

bull SyncPhasor

bull Teleperm XP

bull TIM

bull SNMP

bull SSH

bull SSL

bull ARP


Protokolle

bull Goose

bull IEC 60870-5


bull IEC104

bull Kingfisher

bull Serial Modbus

bull NTP

bull HTTP

bull FTP


D

Introducing

SOC3D



E TOOLS

Memory Dump

ALERTS

SOC 3D

Big-Data

ENRICHMENT

Firewall

IPS

WAF

Active Directory

IT S

YS

TE

MS

OT

AN

D I

OT

SY

ST

EM

S

CMDB

Threat Intel

Logs OS

Service Application

Network Devices

GRC

HR Systems

Compliance


SIEM

IoT Security

Physical Access

Control

OT Security

EDR

UEBA

Helpdesk

CRM

Email

Ticketing


E

ALERTS

SOC 3D

ENRICHMENT

Remedy

Database Query

EDR

SCADAShield

Threat

Intelligence

File AnalysisIAM


SIEM

New

Malware

Alert


Critical

Process

Alert CISO

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Check Asset

Criticality

Check CISO

ContactEscalate

to Tier 2

Investigate

Collect

Additional

Raw Data


and Summary report

Run Memory

Dump Utility

5 minutes5 minutes

5 minutes



minutes

SIEM

New

Malware

Alert


Critical

Process

Alert CISO

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Check Asset

Criticality

Check CISO

ContactEscalate

to Tier 2

Investigate

Collect

Additional

Raw Data


and Summary report

Run Memory

Dump Utility

5 minutes5 minutes

5 minutes


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

ContactAlert CISO


SIEM


and Summary report

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

Contact

Automated

Response

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility

Alert CISO


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Automated

Decision Making

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

Investigate

Check CISO

ContactAlert CISO

Automated

Response

Collect

Additional

Raw Data

Start Here


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Automated

Decision Making

Automated Data

Enrichment

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

ContactAlert CISO

Automated

Response






incidentsday

10 incidents

$600

5 minutes7 stages


per year

TCO savingper day


35 minutes

$2190006 Hours



28

Cyberbit Range


29


Like Fighter Pilots









Weniger als 20







erlebt








Simulations-


Szenarien waumlhlen

Waumlhrend der



der Simulation in

Echtzeit

De-Brief

Untersuchung der

Simulations-

ergebnisse

1 2 3 4




Schwierigkeitsgrad


Art





Checkpoint Firewall

ArcSight

Hard

4 Hrs

Blue Team

Ziele des Szenarios







FTP Exploit

Ping Sweep

SSH Tunneling


Extract DB Data

Port Scanning


34


Scenario Emulator

Instructor Room



Preisbeispiele

SCADAShield






SOC 3D




EDR


unterschieden



Angebot dar


Vielen Dank



5




March 2017






government as the

exclusive endpoint

protection platform

2011 2012 2013 2014 2015 2016 2017 2018

Goes out of stealth

made available to

the commercial

market

Anti-

ransomware

engine

released


WannaCry Petya and


box

First MSSP

rollout


6









Forensics Hunting

and Containment

Detection amp

Analysis Engine

Analysis




bull Anti-Tampering


Forensics Hunting

and Containment

Detection amp

Analysis Engine

Analysis










installation





ransomware


WannaCry






11










bull Fernzugriff







viele Jahre hinweg


OT



Enterprise




switch


Infected

PLC Logic

FW

Infected

USB Keys

Insecure

Remote Support

SIEM ERP ERP

Insecure

Serial Links

Insecure

Modems

Insecure

WirelessInfected

Laptop


Internet firewall

OPC server

firewall

RTUsPLC

s

RTUsPLC

s

RTUsPLC

s













Enterprise




switch


Infected

PLC Logic

FW

Infected

USB Keys

Insecure

Remote Support

SIEM ERP ERP

Insecure

Serial Links

Insecure

Modems

Insecure

WirelessInfected

Laptop


Internet firewall

OPC server

firewall

RTUsPLC

s

RTUsPLC

s

RTUsPLC

s


Platform

Network Sensor

Field IDS

Span P

ort



bull CLNP

bull COTP

bull DCE RPC

bull ENIP

bull EtherNetIP

bull IEEE 8023

bull LLC

bull Ethercat

Hersteller

bull BACNET

bull BVLC

bull CIP

bull CIPCLS

bull CIPCM

bull DNP3

bull MDLC

bull MMS

bull ModbusTCP

bull OMRON-FINS

bull Profibus

bull Profinet CM

bull Profinet DCP

bull Profinet IO

bull Profinet PTCP

bull S7Comm

bull S7Comm Plus

bull SITA

bull SyncPhasor

bull Teleperm XP

bull TIM

bull SNMP

bull SSH

bull SSL

bull ARP


Protokolle

bull Goose

bull IEC 60870-5


bull IEC104

bull Kingfisher

bull Serial Modbus

bull NTP

bull HTTP

bull FTP


D

Introducing

SOC3D



E TOOLS

Memory Dump

ALERTS

SOC 3D

Big-Data

ENRICHMENT

Firewall

IPS

WAF

Active Directory

IT S

YS

TE

MS

OT

AN

D I

OT

SY

ST

EM

S

CMDB

Threat Intel

Logs OS

Service Application

Network Devices

GRC

HR Systems

Compliance


SIEM

IoT Security

Physical Access

Control

OT Security

EDR

UEBA

Helpdesk

CRM

Email

Ticketing


E

ALERTS

SOC 3D

ENRICHMENT

Remedy

Database Query

EDR

SCADAShield

Threat

Intelligence

File AnalysisIAM


SIEM

New

Malware

Alert


Critical

Process

Alert CISO

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Check Asset

Criticality

Check CISO

ContactEscalate

to Tier 2

Investigate

Collect

Additional

Raw Data


and Summary report

Run Memory

Dump Utility

5 minutes5 minutes

5 minutes



minutes

SIEM

New

Malware

Alert


Critical

Process

Alert CISO

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Check Asset

Criticality

Check CISO

ContactEscalate

to Tier 2

Investigate

Collect

Additional

Raw Data


and Summary report

Run Memory

Dump Utility

5 minutes5 minutes

5 minutes


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

ContactAlert CISO


SIEM


and Summary report

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

Contact

Automated

Response

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility

Alert CISO


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Automated

Decision Making

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

Investigate

Check CISO

ContactAlert CISO

Automated

Response

Collect

Additional

Raw Data

Start Here


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Automated

Decision Making

Automated Data

Enrichment

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

ContactAlert CISO

Automated

Response






incidentsday

10 incidents

$600

5 minutes7 stages


per year

TCO savingper day


35 minutes

$2190006 Hours



28

Cyberbit Range


29


Like Fighter Pilots









Weniger als 20







erlebt








Simulations-


Szenarien waumlhlen

Waumlhrend der



der Simulation in

Echtzeit

De-Brief

Untersuchung der

Simulations-

ergebnisse

1 2 3 4




Schwierigkeitsgrad


Art





Checkpoint Firewall

ArcSight

Hard

4 Hrs

Blue Team

Ziele des Szenarios







FTP Exploit

Ping Sweep

SSH Tunneling


Extract DB Data

Port Scanning


34


Scenario Emulator

Instructor Room



Preisbeispiele

SCADAShield






SOC 3D




EDR


unterschieden



Angebot dar


Vielen Dank



government as the

exclusive endpoint

protection platform

2011 2012 2013 2014 2015 2016 2017 2018

Goes out of stealth

made available to

the commercial

market

Anti-

ransomware

engine

released


WannaCry Petya and


box

First MSSP

rollout


6









Forensics Hunting

and Containment

Detection amp

Analysis Engine

Analysis




bull Anti-Tampering


Forensics Hunting

and Containment

Detection amp

Analysis Engine

Analysis










installation





ransomware


WannaCry






11










bull Fernzugriff







viele Jahre hinweg


OT



Enterprise




switch


Infected

PLC Logic

FW

Infected

USB Keys

Insecure

Remote Support

SIEM ERP ERP

Insecure

Serial Links

Insecure

Modems

Insecure

WirelessInfected

Laptop


Internet firewall

OPC server

firewall

RTUsPLC

s

RTUsPLC

s

RTUsPLC

s













Enterprise




switch


Infected

PLC Logic

FW

Infected

USB Keys

Insecure

Remote Support

SIEM ERP ERP

Insecure

Serial Links

Insecure

Modems

Insecure

WirelessInfected

Laptop


Internet firewall

OPC server

firewall

RTUsPLC

s

RTUsPLC

s

RTUsPLC

s


Platform

Network Sensor

Field IDS

Span P

ort



bull CLNP

bull COTP

bull DCE RPC

bull ENIP

bull EtherNetIP

bull IEEE 8023

bull LLC

bull Ethercat

Hersteller

bull BACNET

bull BVLC

bull CIP

bull CIPCLS

bull CIPCM

bull DNP3

bull MDLC

bull MMS

bull ModbusTCP

bull OMRON-FINS

bull Profibus

bull Profinet CM

bull Profinet DCP

bull Profinet IO

bull Profinet PTCP

bull S7Comm

bull S7Comm Plus

bull SITA

bull SyncPhasor

bull Teleperm XP

bull TIM

bull SNMP

bull SSH

bull SSL

bull ARP


Protokolle

bull Goose

bull IEC 60870-5


bull IEC104

bull Kingfisher

bull Serial Modbus

bull NTP

bull HTTP

bull FTP


D

Introducing

SOC3D



E TOOLS

Memory Dump

ALERTS

SOC 3D

Big-Data

ENRICHMENT

Firewall

IPS

WAF

Active Directory

IT S

YS

TE

MS

OT

AN

D I

OT

SY

ST

EM

S

CMDB

Threat Intel

Logs OS

Service Application

Network Devices

GRC

HR Systems

Compliance


SIEM

IoT Security

Physical Access

Control

OT Security

EDR

UEBA

Helpdesk

CRM

Email

Ticketing


E

ALERTS

SOC 3D

ENRICHMENT

Remedy

Database Query

EDR

SCADAShield

Threat

Intelligence

File AnalysisIAM


SIEM

New

Malware

Alert


Critical

Process

Alert CISO

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Check Asset

Criticality

Check CISO

ContactEscalate

to Tier 2

Investigate

Collect

Additional

Raw Data


and Summary report

Run Memory

Dump Utility

5 minutes5 minutes

5 minutes



minutes

SIEM

New

Malware

Alert


Critical

Process

Alert CISO

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Check Asset

Criticality

Check CISO

ContactEscalate

to Tier 2

Investigate

Collect

Additional

Raw Data


and Summary report

Run Memory

Dump Utility

5 minutes5 minutes

5 minutes


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

ContactAlert CISO


SIEM


and Summary report

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

Contact

Automated

Response

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility

Alert CISO


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Automated

Decision Making

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

Investigate

Check CISO

ContactAlert CISO

Automated

Response

Collect

Additional

Raw Data

Start Here


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Automated

Decision Making

Automated Data

Enrichment

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

ContactAlert CISO

Automated

Response






incidentsday

10 incidents

$600

5 minutes7 stages


per year

TCO savingper day


35 minutes

$2190006 Hours



28

Cyberbit Range


29


Like Fighter Pilots









Weniger als 20







erlebt








Simulations-


Szenarien waumlhlen

Waumlhrend der



der Simulation in

Echtzeit

De-Brief

Untersuchung der

Simulations-

ergebnisse

1 2 3 4




Schwierigkeitsgrad


Art





Checkpoint Firewall

ArcSight

Hard

4 Hrs

Blue Team

Ziele des Szenarios







FTP Exploit

Ping Sweep

SSH Tunneling


Extract DB Data

Port Scanning


34


Scenario Emulator

Instructor Room



Preisbeispiele

SCADAShield






SOC 3D




EDR


unterschieden



Angebot dar


Vielen Dank









Forensics Hunting

and Containment

Detection amp

Analysis Engine

Analysis




bull Anti-Tampering


Forensics Hunting

and Containment

Detection amp

Analysis Engine

Analysis










installation





ransomware


WannaCry






11










bull Fernzugriff







viele Jahre hinweg


OT



Enterprise




switch


Infected

PLC Logic

FW

Infected

USB Keys

Insecure

Remote Support

SIEM ERP ERP

Insecure

Serial Links

Insecure

Modems

Insecure

WirelessInfected

Laptop


Internet firewall

OPC server

firewall

RTUsPLC

s

RTUsPLC

s

RTUsPLC

s













Enterprise




switch


Infected

PLC Logic

FW

Infected

USB Keys

Insecure

Remote Support

SIEM ERP ERP

Insecure

Serial Links

Insecure

Modems

Insecure

WirelessInfected

Laptop


Internet firewall

OPC server

firewall

RTUsPLC

s

RTUsPLC

s

RTUsPLC

s


Platform

Network Sensor

Field IDS

Span P

ort



bull CLNP

bull COTP

bull DCE RPC

bull ENIP

bull EtherNetIP

bull IEEE 8023

bull LLC

bull Ethercat

Hersteller

bull BACNET

bull BVLC

bull CIP

bull CIPCLS

bull CIPCM

bull DNP3

bull MDLC

bull MMS

bull ModbusTCP

bull OMRON-FINS

bull Profibus

bull Profinet CM

bull Profinet DCP

bull Profinet IO

bull Profinet PTCP

bull S7Comm

bull S7Comm Plus

bull SITA

bull SyncPhasor

bull Teleperm XP

bull TIM

bull SNMP

bull SSH

bull SSL

bull ARP


Protokolle

bull Goose

bull IEC 60870-5


bull IEC104

bull Kingfisher

bull Serial Modbus

bull NTP

bull HTTP

bull FTP


D

Introducing

SOC3D



E TOOLS

Memory Dump

ALERTS

SOC 3D

Big-Data

ENRICHMENT

Firewall

IPS

WAF

Active Directory

IT S

YS

TE

MS

OT

AN

D I

OT

SY

ST

EM

S

CMDB

Threat Intel

Logs OS

Service Application

Network Devices

GRC

HR Systems

Compliance


SIEM

IoT Security

Physical Access

Control

OT Security

EDR

UEBA

Helpdesk

CRM

Email

Ticketing


E

ALERTS

SOC 3D

ENRICHMENT

Remedy

Database Query

EDR

SCADAShield

Threat

Intelligence

File AnalysisIAM


SIEM

New

Malware

Alert


Critical

Process

Alert CISO

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Check Asset

Criticality

Check CISO

ContactEscalate

to Tier 2

Investigate

Collect

Additional

Raw Data


and Summary report

Run Memory

Dump Utility

5 minutes5 minutes

5 minutes



minutes

SIEM

New

Malware

Alert


Critical

Process

Alert CISO

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Check Asset

Criticality

Check CISO

ContactEscalate

to Tier 2

Investigate

Collect

Additional

Raw Data


and Summary report

Run Memory

Dump Utility

5 minutes5 minutes

5 minutes


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

ContactAlert CISO


SIEM


and Summary report

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

Contact

Automated

Response

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility

Alert CISO


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Automated

Decision Making

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

Investigate

Check CISO

ContactAlert CISO

Automated

Response

Collect

Additional

Raw Data

Start Here


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Automated

Decision Making

Automated Data

Enrichment

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

ContactAlert CISO

Automated

Response






incidentsday

10 incidents

$600

5 minutes7 stages


per year

TCO savingper day


35 minutes

$2190006 Hours



28

Cyberbit Range


29


Like Fighter Pilots









Weniger als 20







erlebt








Simulations-


Szenarien waumlhlen

Waumlhrend der



der Simulation in

Echtzeit

De-Brief

Untersuchung der

Simulations-

ergebnisse

1 2 3 4




Schwierigkeitsgrad


Art





Checkpoint Firewall

ArcSight

Hard

4 Hrs

Blue Team

Ziele des Szenarios







FTP Exploit

Ping Sweep

SSH Tunneling


Extract DB Data

Port Scanning


34


Scenario Emulator

Instructor Room



Preisbeispiele

SCADAShield






SOC 3D




EDR


unterschieden



Angebot dar


Vielen Dank




bull Anti-Tampering


Forensics Hunting

and Containment

Detection amp

Analysis Engine

Analysis










installation





ransomware


WannaCry






11










bull Fernzugriff







viele Jahre hinweg


OT



Enterprise




switch


Infected

PLC Logic

FW

Infected

USB Keys

Insecure

Remote Support

SIEM ERP ERP

Insecure

Serial Links

Insecure

Modems

Insecure

WirelessInfected

Laptop


Internet firewall

OPC server

firewall

RTUsPLC

s

RTUsPLC

s

RTUsPLC

s













Enterprise




switch


Infected

PLC Logic

FW

Infected

USB Keys

Insecure

Remote Support

SIEM ERP ERP

Insecure

Serial Links

Insecure

Modems

Insecure

WirelessInfected

Laptop


Internet firewall

OPC server

firewall

RTUsPLC

s

RTUsPLC

s

RTUsPLC

s


Platform

Network Sensor

Field IDS

Span P

ort



bull CLNP

bull COTP

bull DCE RPC

bull ENIP

bull EtherNetIP

bull IEEE 8023

bull LLC

bull Ethercat

Hersteller

bull BACNET

bull BVLC

bull CIP

bull CIPCLS

bull CIPCM

bull DNP3

bull MDLC

bull MMS

bull ModbusTCP

bull OMRON-FINS

bull Profibus

bull Profinet CM

bull Profinet DCP

bull Profinet IO

bull Profinet PTCP

bull S7Comm

bull S7Comm Plus

bull SITA

bull SyncPhasor

bull Teleperm XP

bull TIM

bull SNMP

bull SSH

bull SSL

bull ARP


Protokolle

bull Goose

bull IEC 60870-5


bull IEC104

bull Kingfisher

bull Serial Modbus

bull NTP

bull HTTP

bull FTP


D

Introducing

SOC3D



E TOOLS

Memory Dump

ALERTS

SOC 3D

Big-Data

ENRICHMENT

Firewall

IPS

WAF

Active Directory

IT S

YS

TE

MS

OT

AN

D I

OT

SY

ST

EM

S

CMDB

Threat Intel

Logs OS

Service Application

Network Devices

GRC

HR Systems

Compliance


SIEM

IoT Security

Physical Access

Control

OT Security

EDR

UEBA

Helpdesk

CRM

Email

Ticketing


E

ALERTS

SOC 3D

ENRICHMENT

Remedy

Database Query

EDR

SCADAShield

Threat

Intelligence

File AnalysisIAM


SIEM

New

Malware

Alert


Critical

Process

Alert CISO

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Check Asset

Criticality

Check CISO

ContactEscalate

to Tier 2

Investigate

Collect

Additional

Raw Data


and Summary report

Run Memory

Dump Utility

5 minutes5 minutes

5 minutes



minutes

SIEM

New

Malware

Alert


Critical

Process

Alert CISO

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Check Asset

Criticality

Check CISO

ContactEscalate

to Tier 2

Investigate

Collect

Additional

Raw Data


and Summary report

Run Memory

Dump Utility

5 minutes5 minutes

5 minutes


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

ContactAlert CISO


SIEM


and Summary report

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

Contact

Automated

Response

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility

Alert CISO


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Automated

Decision Making

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

Investigate

Check CISO

ContactAlert CISO

Automated

Response

Collect

Additional

Raw Data

Start Here


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Automated

Decision Making

Automated Data

Enrichment

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

ContactAlert CISO

Automated

Response






incidentsday

10 incidents

$600

5 minutes7 stages


per year

TCO savingper day


35 minutes

$2190006 Hours



28

Cyberbit Range


29


Like Fighter Pilots









Weniger als 20







erlebt








Simulations-


Szenarien waumlhlen

Waumlhrend der



der Simulation in

Echtzeit

De-Brief

Untersuchung der

Simulations-

ergebnisse

1 2 3 4




Schwierigkeitsgrad


Art





Checkpoint Firewall

ArcSight

Hard

4 Hrs

Blue Team

Ziele des Szenarios







FTP Exploit

Ping Sweep

SSH Tunneling


Extract DB Data

Port Scanning


34


Scenario Emulator

Instructor Room



Preisbeispiele

SCADAShield






SOC 3D




EDR


unterschieden



Angebot dar


Vielen Dank










installation





ransomware


WannaCry






11










bull Fernzugriff







viele Jahre hinweg


OT



Enterprise




switch


Infected

PLC Logic

FW

Infected

USB Keys

Insecure

Remote Support

SIEM ERP ERP

Insecure

Serial Links

Insecure

Modems

Insecure

WirelessInfected

Laptop


Internet firewall

OPC server

firewall

RTUsPLC

s

RTUsPLC

s

RTUsPLC

s













Enterprise




switch


Infected

PLC Logic

FW

Infected

USB Keys

Insecure

Remote Support

SIEM ERP ERP

Insecure

Serial Links

Insecure

Modems

Insecure

WirelessInfected

Laptop


Internet firewall

OPC server

firewall

RTUsPLC

s

RTUsPLC

s

RTUsPLC

s


Platform

Network Sensor

Field IDS

Span P

ort



bull CLNP

bull COTP

bull DCE RPC

bull ENIP

bull EtherNetIP

bull IEEE 8023

bull LLC

bull Ethercat

Hersteller

bull BACNET

bull BVLC

bull CIP

bull CIPCLS

bull CIPCM

bull DNP3

bull MDLC

bull MMS

bull ModbusTCP

bull OMRON-FINS

bull Profibus

bull Profinet CM

bull Profinet DCP

bull Profinet IO

bull Profinet PTCP

bull S7Comm

bull S7Comm Plus

bull SITA

bull SyncPhasor

bull Teleperm XP

bull TIM

bull SNMP

bull SSH

bull SSL

bull ARP


Protokolle

bull Goose

bull IEC 60870-5


bull IEC104

bull Kingfisher

bull Serial Modbus

bull NTP

bull HTTP

bull FTP


D

Introducing

SOC3D



E TOOLS

Memory Dump

ALERTS

SOC 3D

Big-Data

ENRICHMENT

Firewall

IPS

WAF

Active Directory

IT S

YS

TE

MS

OT

AN

D I

OT

SY

ST

EM

S

CMDB

Threat Intel

Logs OS

Service Application

Network Devices

GRC

HR Systems

Compliance


SIEM

IoT Security

Physical Access

Control

OT Security

EDR

UEBA

Helpdesk

CRM

Email

Ticketing


E

ALERTS

SOC 3D

ENRICHMENT

Remedy

Database Query

EDR

SCADAShield

Threat

Intelligence

File AnalysisIAM


SIEM

New

Malware

Alert


Critical

Process

Alert CISO

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Check Asset

Criticality

Check CISO

ContactEscalate

to Tier 2

Investigate

Collect

Additional

Raw Data


and Summary report

Run Memory

Dump Utility

5 minutes5 minutes

5 minutes



minutes

SIEM

New

Malware

Alert


Critical

Process

Alert CISO

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Check Asset

Criticality

Check CISO

ContactEscalate

to Tier 2

Investigate

Collect

Additional

Raw Data


and Summary report

Run Memory

Dump Utility

5 minutes5 minutes

5 minutes


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

ContactAlert CISO


SIEM


and Summary report

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

Contact

Automated

Response

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility

Alert CISO


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Automated

Decision Making

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

Investigate

Check CISO

ContactAlert CISO

Automated

Response

Collect

Additional

Raw Data

Start Here


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Automated

Decision Making

Automated Data

Enrichment

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

ContactAlert CISO

Automated

Response






incidentsday

10 incidents

$600

5 minutes7 stages


per year

TCO savingper day


35 minutes

$2190006 Hours



28

Cyberbit Range


29


Like Fighter Pilots









Weniger als 20







erlebt








Simulations-


Szenarien waumlhlen

Waumlhrend der



der Simulation in

Echtzeit

De-Brief

Untersuchung der

Simulations-

ergebnisse

1 2 3 4




Schwierigkeitsgrad


Art





Checkpoint Firewall

ArcSight

Hard

4 Hrs

Blue Team

Ziele des Szenarios







FTP Exploit

Ping Sweep

SSH Tunneling


Extract DB Data

Port Scanning


34


Scenario Emulator

Instructor Room



Preisbeispiele

SCADAShield






SOC 3D




EDR


unterschieden



Angebot dar


Vielen Dank





ransomware


WannaCry






11










bull Fernzugriff







viele Jahre hinweg


OT



Enterprise




switch


Infected

PLC Logic

FW

Infected

USB Keys

Insecure

Remote Support

SIEM ERP ERP

Insecure

Serial Links

Insecure

Modems

Insecure

WirelessInfected

Laptop


Internet firewall

OPC server

firewall

RTUsPLC

s

RTUsPLC

s

RTUsPLC

s













Enterprise




switch


Infected

PLC Logic

FW

Infected

USB Keys

Insecure

Remote Support

SIEM ERP ERP

Insecure

Serial Links

Insecure

Modems

Insecure

WirelessInfected

Laptop


Internet firewall

OPC server

firewall

RTUsPLC

s

RTUsPLC

s

RTUsPLC

s


Platform

Network Sensor

Field IDS

Span P

ort



bull CLNP

bull COTP

bull DCE RPC

bull ENIP

bull EtherNetIP

bull IEEE 8023

bull LLC

bull Ethercat

Hersteller

bull BACNET

bull BVLC

bull CIP

bull CIPCLS

bull CIPCM

bull DNP3

bull MDLC

bull MMS

bull ModbusTCP

bull OMRON-FINS

bull Profibus

bull Profinet CM

bull Profinet DCP

bull Profinet IO

bull Profinet PTCP

bull S7Comm

bull S7Comm Plus

bull SITA

bull SyncPhasor

bull Teleperm XP

bull TIM

bull SNMP

bull SSH

bull SSL

bull ARP


Protokolle

bull Goose

bull IEC 60870-5


bull IEC104

bull Kingfisher

bull Serial Modbus

bull NTP

bull HTTP

bull FTP


D

Introducing

SOC3D



E TOOLS

Memory Dump

ALERTS

SOC 3D

Big-Data

ENRICHMENT

Firewall

IPS

WAF

Active Directory

IT S

YS

TE

MS

OT

AN

D I

OT

SY

ST

EM

S

CMDB

Threat Intel

Logs OS

Service Application

Network Devices

GRC

HR Systems

Compliance


SIEM

IoT Security

Physical Access

Control

OT Security

EDR

UEBA

Helpdesk

CRM

Email

Ticketing


E

ALERTS

SOC 3D

ENRICHMENT

Remedy

Database Query

EDR

SCADAShield

Threat

Intelligence

File AnalysisIAM


SIEM

New

Malware

Alert


Critical

Process

Alert CISO

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Check Asset

Criticality

Check CISO

ContactEscalate

to Tier 2

Investigate

Collect

Additional

Raw Data


and Summary report

Run Memory

Dump Utility

5 minutes5 minutes

5 minutes



minutes

SIEM

New

Malware

Alert


Critical

Process

Alert CISO

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Check Asset

Criticality

Check CISO

ContactEscalate

to Tier 2

Investigate

Collect

Additional

Raw Data


and Summary report

Run Memory

Dump Utility

5 minutes5 minutes

5 minutes


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

ContactAlert CISO


SIEM


and Summary report

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

Contact

Automated

Response

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility

Alert CISO


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Automated

Decision Making

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

Investigate

Check CISO

ContactAlert CISO

Automated

Response

Collect

Additional

Raw Data

Start Here


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Automated

Decision Making

Automated Data

Enrichment

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

ContactAlert CISO

Automated

Response






incidentsday

10 incidents

$600

5 minutes7 stages


per year

TCO savingper day


35 minutes

$2190006 Hours



28

Cyberbit Range


29


Like Fighter Pilots









Weniger als 20







erlebt








Simulations-


Szenarien waumlhlen

Waumlhrend der



der Simulation in

Echtzeit

De-Brief

Untersuchung der

Simulations-

ergebnisse

1 2 3 4




Schwierigkeitsgrad


Art





Checkpoint Firewall

ArcSight

Hard

4 Hrs

Blue Team

Ziele des Szenarios







FTP Exploit

Ping Sweep

SSH Tunneling


Extract DB Data

Port Scanning


34


Scenario Emulator

Instructor Room



Preisbeispiele

SCADAShield






SOC 3D




EDR


unterschieden



Angebot dar


Vielen Dank




11










bull Fernzugriff







viele Jahre hinweg


OT



Enterprise




switch


Infected

PLC Logic

FW

Infected

USB Keys

Insecure

Remote Support

SIEM ERP ERP

Insecure

Serial Links

Insecure

Modems

Insecure

WirelessInfected

Laptop


Internet firewall

OPC server

firewall

RTUsPLC

s

RTUsPLC

s

RTUsPLC

s













Enterprise




switch


Infected

PLC Logic

FW

Infected

USB Keys

Insecure

Remote Support

SIEM ERP ERP

Insecure

Serial Links

Insecure

Modems

Insecure

WirelessInfected

Laptop


Internet firewall

OPC server

firewall

RTUsPLC

s

RTUsPLC

s

RTUsPLC

s


Platform

Network Sensor

Field IDS

Span P

ort



bull CLNP

bull COTP

bull DCE RPC

bull ENIP

bull EtherNetIP

bull IEEE 8023

bull LLC

bull Ethercat

Hersteller

bull BACNET

bull BVLC

bull CIP

bull CIPCLS

bull CIPCM

bull DNP3

bull MDLC

bull MMS

bull ModbusTCP

bull OMRON-FINS

bull Profibus

bull Profinet CM

bull Profinet DCP

bull Profinet IO

bull Profinet PTCP

bull S7Comm

bull S7Comm Plus

bull SITA

bull SyncPhasor

bull Teleperm XP

bull TIM

bull SNMP

bull SSH

bull SSL

bull ARP


Protokolle

bull Goose

bull IEC 60870-5


bull IEC104

bull Kingfisher

bull Serial Modbus

bull NTP

bull HTTP

bull FTP


D

Introducing

SOC3D



E TOOLS

Memory Dump

ALERTS

SOC 3D

Big-Data

ENRICHMENT

Firewall

IPS

WAF

Active Directory

IT S

YS

TE

MS

OT

AN

D I

OT

SY

ST

EM

S

CMDB

Threat Intel

Logs OS

Service Application

Network Devices

GRC

HR Systems

Compliance


SIEM

IoT Security

Physical Access

Control

OT Security

EDR

UEBA

Helpdesk

CRM

Email

Ticketing


E

ALERTS

SOC 3D

ENRICHMENT

Remedy

Database Query

EDR

SCADAShield

Threat

Intelligence

File AnalysisIAM


SIEM

New

Malware

Alert


Critical

Process

Alert CISO

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Check Asset

Criticality

Check CISO

ContactEscalate

to Tier 2

Investigate

Collect

Additional

Raw Data


and Summary report

Run Memory

Dump Utility

5 minutes5 minutes

5 minutes



minutes

SIEM

New

Malware

Alert


Critical

Process

Alert CISO

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Check Asset

Criticality

Check CISO

ContactEscalate

to Tier 2

Investigate

Collect

Additional

Raw Data


and Summary report

Run Memory

Dump Utility

5 minutes5 minutes

5 minutes


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

ContactAlert CISO


SIEM


and Summary report

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

Contact

Automated

Response

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility

Alert CISO


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Automated

Decision Making

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

Investigate

Check CISO

ContactAlert CISO

Automated

Response

Collect

Additional

Raw Data

Start Here


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Automated

Decision Making

Automated Data

Enrichment

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

ContactAlert CISO

Automated

Response






incidentsday

10 incidents

$600

5 minutes7 stages


per year

TCO savingper day


35 minutes

$2190006 Hours



28

Cyberbit Range


29


Like Fighter Pilots









Weniger als 20







erlebt








Simulations-


Szenarien waumlhlen

Waumlhrend der



der Simulation in

Echtzeit

De-Brief

Untersuchung der

Simulations-

ergebnisse

1 2 3 4




Schwierigkeitsgrad


Art





Checkpoint Firewall

ArcSight

Hard

4 Hrs

Blue Team

Ziele des Szenarios







FTP Exploit

Ping Sweep

SSH Tunneling


Extract DB Data

Port Scanning


34


Scenario Emulator

Instructor Room



Preisbeispiele

SCADAShield






SOC 3D




EDR


unterschieden



Angebot dar


Vielen Dank










bull Fernzugriff







viele Jahre hinweg


OT



Enterprise




switch


Infected

PLC Logic

FW

Infected

USB Keys

Insecure

Remote Support

SIEM ERP ERP

Insecure

Serial Links

Insecure

Modems

Insecure

WirelessInfected

Laptop


Internet firewall

OPC server

firewall

RTUsPLC

s

RTUsPLC

s

RTUsPLC

s













Enterprise




switch


Infected

PLC Logic

FW

Infected

USB Keys

Insecure

Remote Support

SIEM ERP ERP

Insecure

Serial Links

Insecure

Modems

Insecure

WirelessInfected

Laptop


Internet firewall

OPC server

firewall

RTUsPLC

s

RTUsPLC

s

RTUsPLC

s


Platform

Network Sensor

Field IDS

Span P

ort



bull CLNP

bull COTP

bull DCE RPC

bull ENIP

bull EtherNetIP

bull IEEE 8023

bull LLC

bull Ethercat

Hersteller

bull BACNET

bull BVLC

bull CIP

bull CIPCLS

bull CIPCM

bull DNP3

bull MDLC

bull MMS

bull ModbusTCP

bull OMRON-FINS

bull Profibus

bull Profinet CM

bull Profinet DCP

bull Profinet IO

bull Profinet PTCP

bull S7Comm

bull S7Comm Plus

bull SITA

bull SyncPhasor

bull Teleperm XP

bull TIM

bull SNMP

bull SSH

bull SSL

bull ARP


Protokolle

bull Goose

bull IEC 60870-5


bull IEC104

bull Kingfisher

bull Serial Modbus

bull NTP

bull HTTP

bull FTP


D

Introducing

SOC3D



E TOOLS

Memory Dump

ALERTS

SOC 3D

Big-Data

ENRICHMENT

Firewall

IPS

WAF

Active Directory

IT S

YS

TE

MS

OT

AN

D I

OT

SY

ST

EM

S

CMDB

Threat Intel

Logs OS

Service Application

Network Devices

GRC

HR Systems

Compliance


SIEM

IoT Security

Physical Access

Control

OT Security

EDR

UEBA

Helpdesk

CRM

Email

Ticketing


E

ALERTS

SOC 3D

ENRICHMENT

Remedy

Database Query

EDR

SCADAShield

Threat

Intelligence

File AnalysisIAM


SIEM

New

Malware

Alert


Critical

Process

Alert CISO

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Check Asset

Criticality

Check CISO

ContactEscalate

to Tier 2

Investigate

Collect

Additional

Raw Data


and Summary report

Run Memory

Dump Utility

5 minutes5 minutes

5 minutes



minutes

SIEM

New

Malware

Alert


Critical

Process

Alert CISO

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Check Asset

Criticality

Check CISO

ContactEscalate

to Tier 2

Investigate

Collect

Additional

Raw Data


and Summary report

Run Memory

Dump Utility

5 minutes5 minutes

5 minutes


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

ContactAlert CISO


SIEM


and Summary report

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

Contact

Automated

Response

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility

Alert CISO


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Automated

Decision Making

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

Investigate

Check CISO

ContactAlert CISO

Automated

Response

Collect

Additional

Raw Data

Start Here


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Automated

Decision Making

Automated Data

Enrichment

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

ContactAlert CISO

Automated

Response






incidentsday

10 incidents

$600

5 minutes7 stages


per year

TCO savingper day


35 minutes

$2190006 Hours



28

Cyberbit Range


29


Like Fighter Pilots









Weniger als 20







erlebt








Simulations-


Szenarien waumlhlen

Waumlhrend der



der Simulation in

Echtzeit

De-Brief

Untersuchung der

Simulations-

ergebnisse

1 2 3 4




Schwierigkeitsgrad


Art





Checkpoint Firewall

ArcSight

Hard

4 Hrs

Blue Team

Ziele des Szenarios







FTP Exploit

Ping Sweep

SSH Tunneling


Extract DB Data

Port Scanning


34


Scenario Emulator

Instructor Room



Preisbeispiele

SCADAShield






SOC 3D




EDR


unterschieden



Angebot dar


Vielen Dank



Enterprise




switch


Infected

PLC Logic

FW

Infected

USB Keys

Insecure

Remote Support

SIEM ERP ERP

Insecure

Serial Links

Insecure

Modems

Insecure

WirelessInfected

Laptop


Internet firewall

OPC server

firewall

RTUsPLC

s

RTUsPLC

s

RTUsPLC

s













Enterprise




switch


Infected

PLC Logic

FW

Infected

USB Keys

Insecure

Remote Support

SIEM ERP ERP

Insecure

Serial Links

Insecure

Modems

Insecure

WirelessInfected

Laptop


Internet firewall

OPC server

firewall

RTUsPLC

s

RTUsPLC

s

RTUsPLC

s


Platform

Network Sensor

Field IDS

Span P

ort



bull CLNP

bull COTP

bull DCE RPC

bull ENIP

bull EtherNetIP

bull IEEE 8023

bull LLC

bull Ethercat

Hersteller

bull BACNET

bull BVLC

bull CIP

bull CIPCLS

bull CIPCM

bull DNP3

bull MDLC

bull MMS

bull ModbusTCP

bull OMRON-FINS

bull Profibus

bull Profinet CM

bull Profinet DCP

bull Profinet IO

bull Profinet PTCP

bull S7Comm

bull S7Comm Plus

bull SITA

bull SyncPhasor

bull Teleperm XP

bull TIM

bull SNMP

bull SSH

bull SSL

bull ARP


Protokolle

bull Goose

bull IEC 60870-5


bull IEC104

bull Kingfisher

bull Serial Modbus

bull NTP

bull HTTP

bull FTP


D

Introducing

SOC3D



E TOOLS

Memory Dump

ALERTS

SOC 3D

Big-Data

ENRICHMENT

Firewall

IPS

WAF

Active Directory

IT S

YS

TE

MS

OT

AN

D I

OT

SY

ST

EM

S

CMDB

Threat Intel

Logs OS

Service Application

Network Devices

GRC

HR Systems

Compliance


SIEM

IoT Security

Physical Access

Control

OT Security

EDR

UEBA

Helpdesk

CRM

Email

Ticketing


E

ALERTS

SOC 3D

ENRICHMENT

Remedy

Database Query

EDR

SCADAShield

Threat

Intelligence

File AnalysisIAM


SIEM

New

Malware

Alert


Critical

Process

Alert CISO

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Check Asset

Criticality

Check CISO

ContactEscalate

to Tier 2

Investigate

Collect

Additional

Raw Data


and Summary report

Run Memory

Dump Utility

5 minutes5 minutes

5 minutes



minutes

SIEM

New

Malware

Alert


Critical

Process

Alert CISO

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Check Asset

Criticality

Check CISO

ContactEscalate

to Tier 2

Investigate

Collect

Additional

Raw Data


and Summary report

Run Memory

Dump Utility

5 minutes5 minutes

5 minutes


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

ContactAlert CISO


SIEM


and Summary report

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

Contact

Automated

Response

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility

Alert CISO


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Automated

Decision Making

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

Investigate

Check CISO

ContactAlert CISO

Automated

Response

Collect

Additional

Raw Data

Start Here


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Automated

Decision Making

Automated Data

Enrichment

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

ContactAlert CISO

Automated

Response






incidentsday

10 incidents

$600

5 minutes7 stages


per year

TCO savingper day


35 minutes

$2190006 Hours



28

Cyberbit Range


29


Like Fighter Pilots









Weniger als 20







erlebt








Simulations-


Szenarien waumlhlen

Waumlhrend der



der Simulation in

Echtzeit

De-Brief

Untersuchung der

Simulations-

ergebnisse

1 2 3 4




Schwierigkeitsgrad


Art





Checkpoint Firewall

ArcSight

Hard

4 Hrs

Blue Team

Ziele des Szenarios







FTP Exploit

Ping Sweep

SSH Tunneling


Extract DB Data

Port Scanning


34


Scenario Emulator

Instructor Room



Preisbeispiele

SCADAShield






SOC 3D




EDR


unterschieden



Angebot dar


Vielen Dank













Enterprise




switch


Infected

PLC Logic

FW

Infected

USB Keys

Insecure

Remote Support

SIEM ERP ERP

Insecure

Serial Links

Insecure

Modems

Insecure

WirelessInfected

Laptop


Internet firewall

OPC server

firewall

RTUsPLC

s

RTUsPLC

s

RTUsPLC

s


Platform

Network Sensor

Field IDS

Span P

ort



bull CLNP

bull COTP

bull DCE RPC

bull ENIP

bull EtherNetIP

bull IEEE 8023

bull LLC

bull Ethercat

Hersteller

bull BACNET

bull BVLC

bull CIP

bull CIPCLS

bull CIPCM

bull DNP3

bull MDLC

bull MMS

bull ModbusTCP

bull OMRON-FINS

bull Profibus

bull Profinet CM

bull Profinet DCP

bull Profinet IO

bull Profinet PTCP

bull S7Comm

bull S7Comm Plus

bull SITA

bull SyncPhasor

bull Teleperm XP

bull TIM

bull SNMP

bull SSH

bull SSL

bull ARP


Protokolle

bull Goose

bull IEC 60870-5


bull IEC104

bull Kingfisher

bull Serial Modbus

bull NTP

bull HTTP

bull FTP


D

Introducing

SOC3D



E TOOLS

Memory Dump

ALERTS

SOC 3D

Big-Data

ENRICHMENT

Firewall

IPS

WAF

Active Directory

IT S

YS

TE

MS

OT

AN

D I

OT

SY

ST

EM

S

CMDB

Threat Intel

Logs OS

Service Application

Network Devices

GRC

HR Systems

Compliance


SIEM

IoT Security

Physical Access

Control

OT Security

EDR

UEBA

Helpdesk

CRM

Email

Ticketing


E

ALERTS

SOC 3D

ENRICHMENT

Remedy

Database Query

EDR

SCADAShield

Threat

Intelligence

File AnalysisIAM


SIEM

New

Malware

Alert


Critical

Process

Alert CISO

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Check Asset

Criticality

Check CISO

ContactEscalate

to Tier 2

Investigate

Collect

Additional

Raw Data


and Summary report

Run Memory

Dump Utility

5 minutes5 minutes

5 minutes



minutes

SIEM

New

Malware

Alert


Critical

Process

Alert CISO

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Check Asset

Criticality

Check CISO

ContactEscalate

to Tier 2

Investigate

Collect

Additional

Raw Data


and Summary report

Run Memory

Dump Utility

5 minutes5 minutes

5 minutes


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

ContactAlert CISO


SIEM


and Summary report

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

Contact

Automated

Response

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility

Alert CISO


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Automated

Decision Making

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

Investigate

Check CISO

ContactAlert CISO

Automated

Response

Collect

Additional

Raw Data

Start Here


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Automated

Decision Making

Automated Data

Enrichment

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

ContactAlert CISO

Automated

Response






incidentsday

10 incidents

$600

5 minutes7 stages


per year

TCO savingper day


35 minutes

$2190006 Hours



28

Cyberbit Range


29


Like Fighter Pilots









Weniger als 20







erlebt








Simulations-


Szenarien waumlhlen

Waumlhrend der



der Simulation in

Echtzeit

De-Brief

Untersuchung der

Simulations-

ergebnisse

1 2 3 4




Schwierigkeitsgrad


Art





Checkpoint Firewall

ArcSight

Hard

4 Hrs

Blue Team

Ziele des Szenarios







FTP Exploit

Ping Sweep

SSH Tunneling


Extract DB Data

Port Scanning


34


Scenario Emulator

Instructor Room



Preisbeispiele

SCADAShield






SOC 3D




EDR


unterschieden



Angebot dar


Vielen Dank



bull CLNP

bull COTP

bull DCE RPC

bull ENIP

bull EtherNetIP

bull IEEE 8023

bull LLC

bull Ethercat

Hersteller

bull BACNET

bull BVLC

bull CIP

bull CIPCLS

bull CIPCM

bull DNP3

bull MDLC

bull MMS

bull ModbusTCP

bull OMRON-FINS

bull Profibus

bull Profinet CM

bull Profinet DCP

bull Profinet IO

bull Profinet PTCP

bull S7Comm

bull S7Comm Plus

bull SITA

bull SyncPhasor

bull Teleperm XP

bull TIM

bull SNMP

bull SSH

bull SSL

bull ARP


Protokolle

bull Goose

bull IEC 60870-5


bull IEC104

bull Kingfisher

bull Serial Modbus

bull NTP

bull HTTP

bull FTP


D

Introducing

SOC3D



E TOOLS

Memory Dump

ALERTS

SOC 3D

Big-Data

ENRICHMENT

Firewall

IPS

WAF

Active Directory

IT S

YS

TE

MS

OT

AN

D I

OT

SY

ST

EM

S

CMDB

Threat Intel

Logs OS

Service Application

Network Devices

GRC

HR Systems

Compliance


SIEM

IoT Security

Physical Access

Control

OT Security

EDR

UEBA

Helpdesk

CRM

Email

Ticketing


E

ALERTS

SOC 3D

ENRICHMENT

Remedy

Database Query

EDR

SCADAShield

Threat

Intelligence

File AnalysisIAM


SIEM

New

Malware

Alert


Critical

Process

Alert CISO

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Check Asset

Criticality

Check CISO

ContactEscalate

to Tier 2

Investigate

Collect

Additional

Raw Data


and Summary report

Run Memory

Dump Utility

5 minutes5 minutes

5 minutes



minutes

SIEM

New

Malware

Alert


Critical

Process

Alert CISO

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Check Asset

Criticality

Check CISO

ContactEscalate

to Tier 2

Investigate

Collect

Additional

Raw Data


and Summary report

Run Memory

Dump Utility

5 minutes5 minutes

5 minutes


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

ContactAlert CISO


SIEM


and Summary report

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

Contact

Automated

Response

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility

Alert CISO


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Automated

Decision Making

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

Investigate

Check CISO

ContactAlert CISO

Automated

Response

Collect

Additional

Raw Data

Start Here


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Automated

Decision Making

Automated Data

Enrichment

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

ContactAlert CISO

Automated

Response






incidentsday

10 incidents

$600

5 minutes7 stages


per year

TCO savingper day


35 minutes

$2190006 Hours



28

Cyberbit Range


29


Like Fighter Pilots









Weniger als 20







erlebt








Simulations-


Szenarien waumlhlen

Waumlhrend der



der Simulation in

Echtzeit

De-Brief

Untersuchung der

Simulations-

ergebnisse

1 2 3 4




Schwierigkeitsgrad


Art





Checkpoint Firewall

ArcSight

Hard

4 Hrs

Blue Team

Ziele des Szenarios







FTP Exploit

Ping Sweep

SSH Tunneling


Extract DB Data

Port Scanning


34


Scenario Emulator

Instructor Room



Preisbeispiele

SCADAShield






SOC 3D




EDR


unterschieden



Angebot dar


Vielen Dank


D

Introducing

SOC3D



E TOOLS

Memory Dump

ALERTS

SOC 3D

Big-Data

ENRICHMENT

Firewall

IPS

WAF

Active Directory

IT S

YS

TE

MS

OT

AN

D I

OT

SY

ST

EM

S

CMDB

Threat Intel

Logs OS

Service Application

Network Devices

GRC

HR Systems

Compliance


SIEM

IoT Security

Physical Access

Control

OT Security

EDR

UEBA

Helpdesk

CRM

Email

Ticketing


E

ALERTS

SOC 3D

ENRICHMENT

Remedy

Database Query

EDR

SCADAShield

Threat

Intelligence

File AnalysisIAM


SIEM

New

Malware

Alert


Critical

Process

Alert CISO

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Check Asset

Criticality

Check CISO

ContactEscalate

to Tier 2

Investigate

Collect

Additional

Raw Data


and Summary report

Run Memory

Dump Utility

5 minutes5 minutes

5 minutes



minutes

SIEM

New

Malware

Alert


Critical

Process

Alert CISO

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Check Asset

Criticality

Check CISO

ContactEscalate

to Tier 2

Investigate

Collect

Additional

Raw Data


and Summary report

Run Memory

Dump Utility

5 minutes5 minutes

5 minutes


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

ContactAlert CISO


SIEM


and Summary report

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

Contact

Automated

Response

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility

Alert CISO


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Automated

Decision Making

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

Investigate

Check CISO

ContactAlert CISO

Automated

Response

Collect

Additional

Raw Data

Start Here


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Automated

Decision Making

Automated Data

Enrichment

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

ContactAlert CISO

Automated

Response






incidentsday

10 incidents

$600

5 minutes7 stages


per year

TCO savingper day


35 minutes

$2190006 Hours



28

Cyberbit Range


29


Like Fighter Pilots









Weniger als 20







erlebt








Simulations-


Szenarien waumlhlen

Waumlhrend der



der Simulation in

Echtzeit

De-Brief

Untersuchung der

Simulations-

ergebnisse

1 2 3 4




Schwierigkeitsgrad


Art





Checkpoint Firewall

ArcSight

Hard

4 Hrs

Blue Team

Ziele des Szenarios







FTP Exploit

Ping Sweep

SSH Tunneling


Extract DB Data

Port Scanning


34


Scenario Emulator

Instructor Room



Preisbeispiele

SCADAShield






SOC 3D




EDR


unterschieden



Angebot dar


Vielen Dank

Introducing

SOC3D



E TOOLS

Memory Dump

ALERTS

SOC 3D

Big-Data

ENRICHMENT

Firewall

IPS

WAF

Active Directory

IT S

YS

TE

MS

OT

AN

D I

OT

SY

ST

EM

S

CMDB

Threat Intel

Logs OS

Service Application

Network Devices

GRC

HR Systems

Compliance


SIEM

IoT Security

Physical Access

Control

OT Security

EDR

UEBA

Helpdesk

CRM

Email

Ticketing


E

ALERTS

SOC 3D

ENRICHMENT

Remedy

Database Query

EDR

SCADAShield

Threat

Intelligence

File AnalysisIAM


SIEM

New

Malware

Alert


Critical

Process

Alert CISO

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Check Asset

Criticality

Check CISO

ContactEscalate

to Tier 2

Investigate

Collect

Additional

Raw Data


and Summary report

Run Memory

Dump Utility

5 minutes5 minutes

5 minutes



minutes

SIEM

New

Malware

Alert


Critical

Process

Alert CISO

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Check Asset

Criticality

Check CISO

ContactEscalate

to Tier 2

Investigate

Collect

Additional

Raw Data


and Summary report

Run Memory

Dump Utility

5 minutes5 minutes

5 minutes


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

ContactAlert CISO


SIEM


and Summary report

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

Contact

Automated

Response

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility

Alert CISO


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Automated

Decision Making

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

Investigate

Check CISO

ContactAlert CISO

Automated

Response

Collect

Additional

Raw Data

Start Here


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Automated

Decision Making

Automated Data

Enrichment

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

ContactAlert CISO

Automated

Response






incidentsday

10 incidents

$600

5 minutes7 stages


per year

TCO savingper day


35 minutes

$2190006 Hours



28

Cyberbit Range


29


Like Fighter Pilots









Weniger als 20







erlebt








Simulations-


Szenarien waumlhlen

Waumlhrend der



der Simulation in

Echtzeit

De-Brief

Untersuchung der

Simulations-

ergebnisse

1 2 3 4




Schwierigkeitsgrad


Art





Checkpoint Firewall

ArcSight

Hard

4 Hrs

Blue Team

Ziele des Szenarios







FTP Exploit

Ping Sweep

SSH Tunneling


Extract DB Data

Port Scanning


34


Scenario Emulator

Instructor Room



Preisbeispiele

SCADAShield






SOC 3D




EDR


unterschieden



Angebot dar


Vielen Dank


E TOOLS

Memory Dump

ALERTS

SOC 3D

Big-Data

ENRICHMENT

Firewall

IPS

WAF

Active Directory

IT S

YS

TE

MS

OT

AN

D I

OT

SY

ST

EM

S

CMDB

Threat Intel

Logs OS

Service Application

Network Devices

GRC

HR Systems

Compliance


SIEM

IoT Security

Physical Access

Control

OT Security

EDR

UEBA

Helpdesk

CRM

Email

Ticketing


E

ALERTS

SOC 3D

ENRICHMENT

Remedy

Database Query

EDR

SCADAShield

Threat

Intelligence

File AnalysisIAM


SIEM

New

Malware

Alert


Critical

Process

Alert CISO

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Check Asset

Criticality

Check CISO

ContactEscalate

to Tier 2

Investigate

Collect

Additional

Raw Data


and Summary report

Run Memory

Dump Utility

5 minutes5 minutes

5 minutes



minutes

SIEM

New

Malware

Alert


Critical

Process

Alert CISO

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Check Asset

Criticality

Check CISO

ContactEscalate

to Tier 2

Investigate

Collect

Additional

Raw Data


and Summary report

Run Memory

Dump Utility

5 minutes5 minutes

5 minutes


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

ContactAlert CISO


SIEM


and Summary report

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

Contact

Automated

Response

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility

Alert CISO


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Automated

Decision Making

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

Investigate

Check CISO

ContactAlert CISO

Automated

Response

Collect

Additional

Raw Data

Start Here


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Automated

Decision Making

Automated Data

Enrichment

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

ContactAlert CISO

Automated

Response






incidentsday

10 incidents

$600

5 minutes7 stages


per year

TCO savingper day


35 minutes

$2190006 Hours



28

Cyberbit Range


29


Like Fighter Pilots









Weniger als 20







erlebt








Simulations-


Szenarien waumlhlen

Waumlhrend der



der Simulation in

Echtzeit

De-Brief

Untersuchung der

Simulations-

ergebnisse

1 2 3 4




Schwierigkeitsgrad


Art





Checkpoint Firewall

ArcSight

Hard

4 Hrs

Blue Team

Ziele des Szenarios







FTP Exploit

Ping Sweep

SSH Tunneling


Extract DB Data

Port Scanning


34


Scenario Emulator

Instructor Room



Preisbeispiele

SCADAShield






SOC 3D




EDR


unterschieden



Angebot dar


Vielen Dank


E

ALERTS

SOC 3D

ENRICHMENT

Remedy

Database Query

EDR

SCADAShield

Threat

Intelligence

File AnalysisIAM


SIEM

New

Malware

Alert


Critical

Process

Alert CISO

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Check Asset

Criticality

Check CISO

ContactEscalate

to Tier 2

Investigate

Collect

Additional

Raw Data


and Summary report

Run Memory

Dump Utility

5 minutes5 minutes

5 minutes



minutes

SIEM

New

Malware

Alert


Critical

Process

Alert CISO

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Check Asset

Criticality

Check CISO

ContactEscalate

to Tier 2

Investigate

Collect

Additional

Raw Data


and Summary report

Run Memory

Dump Utility

5 minutes5 minutes

5 minutes


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

ContactAlert CISO


SIEM


and Summary report

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

Contact

Automated

Response

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility

Alert CISO


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Automated

Decision Making

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

Investigate

Check CISO

ContactAlert CISO

Automated

Response

Collect

Additional

Raw Data

Start Here


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Automated

Decision Making

Automated Data

Enrichment

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

ContactAlert CISO

Automated

Response






incidentsday

10 incidents

$600

5 minutes7 stages


per year

TCO savingper day


35 minutes

$2190006 Hours



28

Cyberbit Range


29


Like Fighter Pilots









Weniger als 20







erlebt








Simulations-


Szenarien waumlhlen

Waumlhrend der



der Simulation in

Echtzeit

De-Brief

Untersuchung der

Simulations-

ergebnisse

1 2 3 4




Schwierigkeitsgrad


Art





Checkpoint Firewall

ArcSight

Hard

4 Hrs

Blue Team

Ziele des Szenarios







FTP Exploit

Ping Sweep

SSH Tunneling


Extract DB Data

Port Scanning


34


Scenario Emulator

Instructor Room



Preisbeispiele

SCADAShield






SOC 3D




EDR


unterschieden



Angebot dar


Vielen Dank


SIEM

New

Malware

Alert


Critical

Process

Alert CISO

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Check Asset

Criticality

Check CISO

ContactEscalate

to Tier 2

Investigate

Collect

Additional

Raw Data


and Summary report

Run Memory

Dump Utility

5 minutes5 minutes

5 minutes



minutes

SIEM

New

Malware

Alert


Critical

Process

Alert CISO

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Check Asset

Criticality

Check CISO

ContactEscalate

to Tier 2

Investigate

Collect

Additional

Raw Data


and Summary report

Run Memory

Dump Utility

5 minutes5 minutes

5 minutes


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

ContactAlert CISO


SIEM


and Summary report

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

Contact

Automated

Response

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility

Alert CISO


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Automated

Decision Making

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

Investigate

Check CISO

ContactAlert CISO

Automated

Response

Collect

Additional

Raw Data

Start Here


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Automated

Decision Making

Automated Data

Enrichment

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

ContactAlert CISO

Automated

Response






incidentsday

10 incidents

$600

5 minutes7 stages


per year

TCO savingper day


35 minutes

$2190006 Hours



28

Cyberbit Range


29


Like Fighter Pilots









Weniger als 20







erlebt








Simulations-


Szenarien waumlhlen

Waumlhrend der



der Simulation in

Echtzeit

De-Brief

Untersuchung der

Simulations-

ergebnisse

1 2 3 4




Schwierigkeitsgrad


Art





Checkpoint Firewall

ArcSight

Hard

4 Hrs

Blue Team

Ziele des Szenarios







FTP Exploit

Ping Sweep

SSH Tunneling


Extract DB Data

Port Scanning


34


Scenario Emulator

Instructor Room



Preisbeispiele

SCADAShield






SOC 3D




EDR


unterschieden



Angebot dar


Vielen Dank



minutes

SIEM

New

Malware

Alert


Critical

Process

Alert CISO

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Check Asset

Criticality

Check CISO

ContactEscalate

to Tier 2

Investigate

Collect

Additional

Raw Data


and Summary report

Run Memory

Dump Utility

5 minutes5 minutes

5 minutes


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

ContactAlert CISO


SIEM


and Summary report

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

Contact

Automated

Response

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility

Alert CISO


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Automated

Decision Making

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

Investigate

Check CISO

ContactAlert CISO

Automated

Response

Collect

Additional

Raw Data

Start Here


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Automated

Decision Making

Automated Data

Enrichment

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

ContactAlert CISO

Automated

Response






incidentsday

10 incidents

$600

5 minutes7 stages


per year

TCO savingper day


35 minutes

$2190006 Hours



28

Cyberbit Range


29


Like Fighter Pilots









Weniger als 20







erlebt








Simulations-


Szenarien waumlhlen

Waumlhrend der



der Simulation in

Echtzeit

De-Brief

Untersuchung der

Simulations-

ergebnisse

1 2 3 4




Schwierigkeitsgrad


Art





Checkpoint Firewall

ArcSight

Hard

4 Hrs

Blue Team

Ziele des Szenarios







FTP Exploit

Ping Sweep

SSH Tunneling


Extract DB Data

Port Scanning


34


Scenario Emulator

Instructor Room



Preisbeispiele

SCADAShield






SOC 3D




EDR


unterschieden



Angebot dar


Vielen Dank


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

ContactAlert CISO


SIEM


and Summary report

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

Contact

Automated

Response

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility

Alert CISO


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Automated

Decision Making

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

Investigate

Check CISO

ContactAlert CISO

Automated

Response

Collect

Additional

Raw Data

Start Here


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Automated

Decision Making

Automated Data

Enrichment

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

ContactAlert CISO

Automated

Response






incidentsday

10 incidents

$600

5 minutes7 stages


per year

TCO savingper day


35 minutes

$2190006 Hours



28

Cyberbit Range


29


Like Fighter Pilots









Weniger als 20







erlebt








Simulations-


Szenarien waumlhlen

Waumlhrend der



der Simulation in

Echtzeit

De-Brief

Untersuchung der

Simulations-

ergebnisse

1 2 3 4




Schwierigkeitsgrad


Art





Checkpoint Firewall

ArcSight

Hard

4 Hrs

Blue Team

Ziele des Szenarios







FTP Exploit

Ping Sweep

SSH Tunneling


Extract DB Data

Port Scanning


34


Scenario Emulator

Instructor Room



Preisbeispiele

SCADAShield






SOC 3D




EDR


unterschieden



Angebot dar


Vielen Dank


SIEM


and Summary report

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

Contact

Automated

Response

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility

Alert CISO


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Automated

Decision Making

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

Investigate

Check CISO

ContactAlert CISO

Automated

Response

Collect

Additional

Raw Data

Start Here


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Automated

Decision Making

Automated Data

Enrichment

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

ContactAlert CISO

Automated

Response






incidentsday

10 incidents

$600

5 minutes7 stages


per year

TCO savingper day


35 minutes

$2190006 Hours



28

Cyberbit Range


29


Like Fighter Pilots









Weniger als 20







erlebt








Simulations-


Szenarien waumlhlen

Waumlhrend der



der Simulation in

Echtzeit

De-Brief

Untersuchung der

Simulations-

ergebnisse

1 2 3 4




Schwierigkeitsgrad


Art





Checkpoint Firewall

ArcSight

Hard

4 Hrs

Blue Team

Ziele des Szenarios







FTP Exploit

Ping Sweep

SSH Tunneling


Extract DB Data

Port Scanning


34


Scenario Emulator

Instructor Room



Preisbeispiele

SCADAShield






SOC 3D




EDR


unterschieden



Angebot dar


Vielen Dank


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Automated

Decision Making

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

Investigate

Check CISO

ContactAlert CISO

Automated

Response

Collect

Additional

Raw Data

Start Here


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Automated

Decision Making

Automated Data

Enrichment

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

ContactAlert CISO

Automated

Response






incidentsday

10 incidents

$600

5 minutes7 stages


per year

TCO savingper day


35 minutes

$2190006 Hours



28

Cyberbit Range


29


Like Fighter Pilots









Weniger als 20







erlebt








Simulations-


Szenarien waumlhlen

Waumlhrend der



der Simulation in

Echtzeit

De-Brief

Untersuchung der

Simulations-

ergebnisse

1 2 3 4




Schwierigkeitsgrad


Art





Checkpoint Firewall

ArcSight

Hard

4 Hrs

Blue Team

Ziele des Szenarios







FTP Exploit

Ping Sweep

SSH Tunneling


Extract DB Data

Port Scanning


34


Scenario Emulator

Instructor Room



Preisbeispiele

SCADAShield






SOC 3D




EDR


unterschieden



Angebot dar


Vielen Dank

Start Here


SIEM

Isolate Host

Using NAC API

Alert IT to

Replace User

Host

Run Memory

Dump Utility


and Summary report

Automated

Decision Making

Automated Data

Enrichment

Check Asset

Criticality

New

Malware

Alert

Critical

Process

Escalate

to Tier 2

InvestigateCollect

Additional

Raw Data

Check CISO

ContactAlert CISO

Automated

Response






incidentsday

10 incidents

$600

5 minutes7 stages


per year

TCO savingper day


35 minutes

$2190006 Hours



28

Cyberbit Range


29


Like Fighter Pilots









Weniger als 20







erlebt








Simulations-


Szenarien waumlhlen

Waumlhrend der



der Simulation in

Echtzeit

De-Brief

Untersuchung der

Simulations-

ergebnisse

1 2 3 4




Schwierigkeitsgrad


Art





Checkpoint Firewall

ArcSight

Hard

4 Hrs

Blue Team

Ziele des Szenarios







FTP Exploit

Ping Sweep

SSH Tunneling


Extract DB Data

Port Scanning


34


Scenario Emulator

Instructor Room



Preisbeispiele

SCADAShield






SOC 3D




EDR


unterschieden



Angebot dar


Vielen Dank






incidentsday

10 incidents

$600

5 minutes7 stages


per year

TCO savingper day


35 minutes

$2190006 Hours



28

Cyberbit Range


29


Like Fighter Pilots









Weniger als 20







erlebt








Simulations-


Szenarien waumlhlen

Waumlhrend der



der Simulation in

Echtzeit

De-Brief

Untersuchung der

Simulations-

ergebnisse

1 2 3 4




Schwierigkeitsgrad


Art





Checkpoint Firewall

ArcSight

Hard

4 Hrs

Blue Team

Ziele des Szenarios







FTP Exploit

Ping Sweep

SSH Tunneling


Extract DB Data

Port Scanning


34


Scenario Emulator

Instructor Room



Preisbeispiele

SCADAShield






SOC 3D




EDR


unterschieden



Angebot dar


Vielen Dank


28

Cyberbit Range


29


Like Fighter Pilots









Weniger als 20







erlebt








Simulations-


Szenarien waumlhlen

Waumlhrend der



der Simulation in

Echtzeit

De-Brief

Untersuchung der

Simulations-

ergebnisse

1 2 3 4




Schwierigkeitsgrad


Art





Checkpoint Firewall

ArcSight

Hard

4 Hrs

Blue Team

Ziele des Szenarios







FTP Exploit

Ping Sweep

SSH Tunneling


Extract DB Data

Port Scanning


34


Scenario Emulator

Instructor Room



Preisbeispiele

SCADAShield






SOC 3D




EDR


unterschieden



Angebot dar


Vielen Dank


29


Like Fighter Pilots









Weniger als 20







erlebt








Simulations-


Szenarien waumlhlen

Waumlhrend der



der Simulation in

Echtzeit

De-Brief

Untersuchung der

Simulations-

ergebnisse

1 2 3 4




Schwierigkeitsgrad


Art





Checkpoint Firewall

ArcSight

Hard

4 Hrs

Blue Team

Ziele des Szenarios







FTP Exploit

Ping Sweep

SSH Tunneling


Extract DB Data

Port Scanning


34


Scenario Emulator

Instructor Room



Preisbeispiele

SCADAShield






SOC 3D




EDR


unterschieden



Angebot dar


Vielen Dank









Weniger als 20







erlebt








Simulations-


Szenarien waumlhlen

Waumlhrend der



der Simulation in

Echtzeit

De-Brief

Untersuchung der

Simulations-

ergebnisse

1 2 3 4




Schwierigkeitsgrad


Art





Checkpoint Firewall

ArcSight

Hard

4 Hrs

Blue Team

Ziele des Szenarios







FTP Exploit

Ping Sweep

SSH Tunneling


Extract DB Data

Port Scanning


34


Scenario Emulator

Instructor Room



Preisbeispiele

SCADAShield






SOC 3D




EDR


unterschieden



Angebot dar


Vielen Dank


Simulations-


Szenarien waumlhlen

Waumlhrend der



der Simulation in

Echtzeit

De-Brief

Untersuchung der

Simulations-

ergebnisse

1 2 3 4




Schwierigkeitsgrad


Art





Checkpoint Firewall

ArcSight

Hard

4 Hrs

Blue Team

Ziele des Szenarios







FTP Exploit

Ping Sweep

SSH Tunneling


Extract DB Data

Port Scanning


34


Scenario Emulator

Instructor Room



Preisbeispiele

SCADAShield






SOC 3D




EDR


unterschieden



Angebot dar


Vielen Dank



Schwierigkeitsgrad


Art





Checkpoint Firewall

ArcSight

Hard

4 Hrs

Blue Team

Ziele des Szenarios







FTP Exploit

Ping Sweep

SSH Tunneling


Extract DB Data

Port Scanning


34


Scenario Emulator

Instructor Room



Preisbeispiele

SCADAShield






SOC 3D




EDR


unterschieden



Angebot dar


Vielen Dank


34


Scenario Emulator

Instructor Room



Preisbeispiele

SCADAShield






SOC 3D




EDR


unterschieden



Angebot dar


Vielen Dank


Preisbeispiele

SCADAShield






SOC 3D




EDR


unterschieden



Angebot dar


Vielen Dank


Vielen Dank

cyberbit gmbh münchen - infinigate deutschland gmbh · malware prevention |prevent known and...

Documents