![Page 1: Improving Your Security Posture June 24, 2014 1 Managing Your Managed Security Service Provider Stephen Seljan, General Dynamics Fidelis](https://reader036.vdocuments.us/reader036/viewer/2022062321/56649da85503460f94a94862/html5/thumbnails/1.jpg)
Improving Your Security Posture
June 24, 2014
1
Managing Your Managed Security Service Provider
Stephen Seljan, General Dynamics Fidelis
![Page 2: Improving Your Security Posture June 24, 2014 1 Managing Your Managed Security Service Provider Stephen Seljan, General Dynamics Fidelis](https://reader036.vdocuments.us/reader036/viewer/2022062321/56649da85503460f94a94862/html5/thumbnails/2.jpg)
Introduction
SOC Analyst Expectations
Event Analysis
Event Tuning
Device Logging
Negative vs. Positive Filters
Conclusion & Questions
Overview
![Page 3: Improving Your Security Posture June 24, 2014 1 Managing Your Managed Security Service Provider Stephen Seljan, General Dynamics Fidelis](https://reader036.vdocuments.us/reader036/viewer/2022062321/56649da85503460f94a94862/html5/thumbnails/3.jpg)
Does your MSSP know your critical infrastructure?
Does your MSSP know what alerts are important to you?
Does your MSSP know whatyou are vulnerable to?
Do you work with your MSSPto tune alerts on a daily/weekly basis?
Do you ensure all security devices and logs are reporting as they should be?
Do you perform frequent review of old alerts
Critical Questions
![Page 4: Improving Your Security Posture June 24, 2014 1 Managing Your Managed Security Service Provider Stephen Seljan, General Dynamics Fidelis](https://reader036.vdocuments.us/reader036/viewer/2022062321/56649da85503460f94a94862/html5/thumbnails/4.jpg)
SOC Analyst Expectations
SOC Analyst Expectations
![Page 5: Improving Your Security Posture June 24, 2014 1 Managing Your Managed Security Service Provider Stephen Seljan, General Dynamics Fidelis](https://reader036.vdocuments.us/reader036/viewer/2022062321/56649da85503460f94a94862/html5/thumbnails/5.jpg)
Event Analysis (or the lack of)
![Page 6: Improving Your Security Posture June 24, 2014 1 Managing Your Managed Security Service Provider Stephen Seljan, General Dynamics Fidelis](https://reader036.vdocuments.us/reader036/viewer/2022062321/56649da85503460f94a94862/html5/thumbnails/6.jpg)
Device Logging
![Page 7: Improving Your Security Posture June 24, 2014 1 Managing Your Managed Security Service Provider Stephen Seljan, General Dynamics Fidelis](https://reader036.vdocuments.us/reader036/viewer/2022062321/56649da85503460f94a94862/html5/thumbnails/7.jpg)
Device Trending
![Page 8: Improving Your Security Posture June 24, 2014 1 Managing Your Managed Security Service Provider Stephen Seljan, General Dynamics Fidelis](https://reader036.vdocuments.us/reader036/viewer/2022062321/56649da85503460f94a94862/html5/thumbnails/8.jpg)
Positive vs.
Negative Filters
![Page 9: Improving Your Security Posture June 24, 2014 1 Managing Your Managed Security Service Provider Stephen Seljan, General Dynamics Fidelis](https://reader036.vdocuments.us/reader036/viewer/2022062321/56649da85503460f94a94862/html5/thumbnails/9.jpg)
Event ReviewWhy an Event Review? Because you don’t know what you don’t know until you know it
• Takes an average of 225 days to detect APTs
• Days, weeks, even months for AV to detect new Malware
• New indicators of compromise released everyday
• New rules pushed daily to IDS/IPS systems
• Poorly written filters
![Page 10: Improving Your Security Posture June 24, 2014 1 Managing Your Managed Security Service Provider Stephen Seljan, General Dynamics Fidelis](https://reader036.vdocuments.us/reader036/viewer/2022062321/56649da85503460f94a94862/html5/thumbnails/10.jpg)
Conclusion & Questions