Upload File

enhanced security mitigation via automationverizon 2018 data breach investigations report ......

  • Home
  • Documents
  • Enhanced Security Mitigation via AutomationVerizon 2018 Data Breach Investigations Report ... •Reduce Time to Detection •Mitigate the Threat •NOC-SOC Integration Automated Security
17
Enhanced Security Mitigation via Automation Steve Mulhearn Consulting Director

Upload: others

Post on 06-Aug-2020

3 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: Enhanced Security Mitigation via AutomationVerizon 2018 Data Breach Investigations Report ... •Reduce Time to Detection •Mitigate the Threat •NOC-SOC Integration Automated Security

Enhanced Security Mitigation via Automation

Steve Mulhearn Consulting Director

Page 2: Enhanced Security Mitigation via AutomationVerizon 2018 Data Breach Investigations Report ... •Reduce Time to Detection •Mitigate the Threat •NOC-SOC Integration Automated Security

2

The Evolving Threat Landscape Giant Equifax data breach: 143 million people could be affected Equifax says a giant cybersecurity breach compromised the personal information of

as many as 143 million Americans — almost half the country

CNNtech | September 8, 2017: 9:23 AM ET

> $1 Source: FBI, 2016

2017

35x Source: FortiGuard Labs, 2017

2017

#1 Email

Malvertisement

AI

aaS Bad Rabbit: Game of Thrones-

referencing ransomware hits Europe NotPetya-style malware infects Kiev’s metro system, Odessa airport and Russian

media, demanding bitcoin for decryption key

The Guardian | Wednesday 25 October 2017 06.06 EDT

Why ‘WannaCry’ Malware Caused Chaos for

National Health Service in U.K.

SELF PROPOGATE

Page 3: Enhanced Security Mitigation via AutomationVerizon 2018 Data Breach Investigations Report ... •Reduce Time to Detection •Mitigate the Threat •NOC-SOC Integration Automated Security

3

Concern #1 The Enterprise Attack Surface is Broad

Email Attachment

Web drive-by

Email link

Download malware

Network propagation

Incident count

Top 5 Avenues for Crimeware

Source: Verizon. 2016 Data Breach Investigations Report. 2016.

#1 Phishing

Malvertisement

Page 4: Enhanced Security Mitigation via AutomationVerizon 2018 Data Breach Investigations Report ... •Reduce Time to Detection •Mitigate the Threat •NOC-SOC Integration Automated Security

4

EMAIL ATTACHMENT

WEB-DRIVE-BY EMAIL LINK

What are the Most Common Threat Vectors? All Rely on Social Engineering

Page 5: Enhanced Security Mitigation via AutomationVerizon 2018 Data Breach Investigations Report ... •Reduce Time to Detection •Mitigate the Threat •NOC-SOC Integration Automated Security

5

Time To Discover a Breach For the majority, TTD is too long and it is already too late!

Verizon 2018 Data Breach Investigations Report

https://enterprise.verizon.com/resources/reports/DBIR_2018_Report_execsummary.pdf

Page 6: Enhanced Security Mitigation via AutomationVerizon 2018 Data Breach Investigations Report ... •Reduce Time to Detection •Mitigate the Threat •NOC-SOC Integration Automated Security

6

Cyber Skills Shortage

UK

90%

Region

USA India LATAM Oceania Globally

87% 87& 86% 85% 86%

ISACA members who believe there is a shortage

of skilled cybersecurity professionals (%)

Page 7: Enhanced Security Mitigation via AutomationVerizon 2018 Data Breach Investigations Report ... •Reduce Time to Detection •Mitigate the Threat •NOC-SOC Integration Automated Security

7

Why Are the Criminals So Successful?

THEY TALK

to each other

THEY TRADE

with each other

THEY SHARE

intellectual property

THEY HAVE

A COMMON GOAL

They are

NOT LIMITED BY RULES

THEY INTEGRATE

their tools together

Page 8: Enhanced Security Mitigation via AutomationVerizon 2018 Data Breach Investigations Report ... •Reduce Time to Detection •Mitigate the Threat •NOC-SOC Integration Automated Security

8

FORTIGUARD LABS 2018 Since 2000, FortiGuard Labs has provided in-house, industry-leading security intelligence

and research, powering Fortinet’s platform and delivering a suite of advanced services

Industry Leading Patented

Security Technology

Zero-day Research

500 0-days discovered (Q4’17)

Delivering Advanced Technologies

FortiSandbox

Anti-Exploit Engine (FortiClient)

Delivering Intelligence Services

CPRL AV, IPS, App Control, IP Reputation,

Web Filter, Anti-Spam, Web Security App,

Vulnerability Management

Virus Outbreak Service and Content Disarm &

Reconstruction

(FortiMail and FortiGate)

Published Research

Quarterly Threat Report

Bi-weekly Threat Brief

Blogs

Page 9: Enhanced Security Mitigation via AutomationVerizon 2018 Data Breach Investigations Report ... •Reduce Time to Detection •Mitigate the Threat •NOC-SOC Integration Automated Security

9

• Fortinet Automation

• Detect 0-day from unkown objects (files or URLs)

• Reduce Time to Detection

• Mitigate the Threat

• NOC-SOC Integration

Automated Security Fabric

6.0

Page 10: Enhanced Security Mitigation via AutomationVerizon 2018 Data Breach Investigations Report ... •Reduce Time to Detection •Mitigate the Threat •NOC-SOC Integration Automated Security

10

That is Fully Automated ATP Framework: Automated Intelligence Sharing and Response

FortiClient (ATP Agent)

3rd party Endpoint Agent

FortiGate/FortiMail/FortiWeb/FortiADC/FortiProxy/ICAP Device

FortiGuard Labs

Intelligence Sharing 3b

Quarantine Devices

Security Updates 4

Real-time Intelligence Updates 3a

FortiSandbox

1 1 File Submission/ Result File Submission/ Result

Block Objects 2a

2b

File Quarantine 2a

Page 11: Enhanced Security Mitigation via AutomationVerizon 2018 Data Breach Investigations Report ... •Reduce Time to Detection •Mitigate the Threat •NOC-SOC Integration Automated Security

11

• What it is

• Real-time emerging threat signature database

• Up-to-date protection vs traditional AV updates

• Applies to FortiGate and FortiMail

• Benefits

• Reduces detection time of latest known malware

• Including FortiSandbox pre-filter stage

• How does FortiSandbox compliment this service

• Detects Zero-day/Unknown Malware

• Newly acquired intelligence contributes to VOS service

Virus Outbreak Service (VOS) with FortiSandbox

Page 12: Enhanced Security Mitigation via AutomationVerizon 2018 Data Breach Investigations Report ... •Reduce Time to Detection •Mitigate the Threat •NOC-SOC Integration Automated Security

12

• What it is

• Strips active content (scripts, macros, etc) from Office and Adobe documents

• Benefits

• Eliminates the possibility of infection via documents

• Real-time document disarmament with no delay

• How does FortiSandbox complement this service

• Analyze the original documents to identify breach attempts

• Detects Zero-day/Unknown executable malware

Content Disarm & Reconstruct (CDR) with FortiSandbox

Page 13: Enhanced Security Mitigation via AutomationVerizon 2018 Data Breach Investigations Report ... •Reduce Time to Detection •Mitigate the Threat •NOC-SOC Integration Automated Security

13

FortiSIEM Remediations Library

Page 14: Enhanced Security Mitigation via AutomationVerizon 2018 Data Breach Investigations Report ... •Reduce Time to Detection •Mitigate the Threat •NOC-SOC Integration Automated Security

14

NOC-SOC VIEW

Page 15: Enhanced Security Mitigation via AutomationVerizon 2018 Data Breach Investigations Report ... •Reduce Time to Detection •Mitigate the Threat •NOC-SOC Integration Automated Security

15

Where is it Going ?

SEAMLESS INTEGRATION WITH INDIVIDUAL SYSTEMS

IMPROVED VENDOR COMMUNICATION

BETTER COMMUNICATION

MORE INTELLIGENT SYSTEMS

IMPROVED INTELLIGENCE

INTERWOVEN SOLUTIONS PROVIDING INTELLIGENT ACCURATE REPORTING

Page 16: Enhanced Security Mitigation via AutomationVerizon 2018 Data Breach Investigations Report ... •Reduce Time to Detection •Mitigate the Threat •NOC-SOC Integration Automated Security

16

The Solution: Fortinet Security Fabric

NETWORK

MULTI-CLOUD PARTNER API

EMAIL UNIFIED ACCESS

IOT-ENDPOINT WEB APPS

ADVANCED THREAT PROTECTION

MANAGEMENT-ANALYTICS

BROAD INTEGRATED AUTOMATED

Page 17: Enhanced Security Mitigation via AutomationVerizon 2018 Data Breach Investigations Report ... •Reduce Time to Detection •Mitigate the Threat •NOC-SOC Integration Automated Security

Thank you


Strategies to Mitigate Cyber Security Incidents ... · Strategies to Mitigate Cyber Security Incidents publication. Additional information is provided in this document to help organisations

Security Bootcamp 2013 mitigate d do-s attack with effective cost

Secure ARP and Secure DHCP Protocols to Mitigate Security ... · Secure ARP and Secure DHCP Protocols to Mitigate Security Attacks ... (ARP) is devel-oped to nd the Ethernet address

False Assurance in Smartphone Security for Userscs.lewisu.edu/mathcs/msis/projects/msis595_TungNguyen.pdf · necessary information to mitigate security issue(s) for smartphone owners

How Pixims Digital Pixel System® Technology Helps Mitigate Airport Security Threats July 2008

BUILDIN NUMBER BASEME NUMBER NOC Sr. APPROVAL S NOC

NOC GEM & MINERAL SOCIETY NOC NEWS - NOC Web Site · 2007-09-20 · NOC GEM & MINERAL SOCIETY NOC NEWS Vol, 26 No. 7 September 2007 President’s Message Date: September 11 ... Your

NoC Bergman

ANTICIPATE. MITIGATE. PROTECT. - Bloomberg BNA...ANTICIPATE. MITIGATE. PROTECT. ... Assembled by a team of international privacy and data security experts, access detailed content,

NOC-centric Security of Reconfigurable SoCsdiguet/papers/NoC2007_Diguet_6may.pdfNOC-centric Security of Reconfigurable SoCs ... Traditional network security (IDS) not applicable in

Virtualization and Security Aware Multi-core Architecture ... · Network-on-chip (NoC) as an interconnection solution for better scalability and performance. This NoC has been designed

Mobilink NOC Dept. By Faras Rafiq Ex- NOC (NSS) Engineer

(NOC) Mirzapur Cadet College 08 | …...(NOC) Mirzapur Cadet College 08 | (NOC) (ÞÄ) I [email protected] wwy.mcc.army..mil.bd (NOC) I

FORTINET AND SERVICENOW INTEGRATED … · SOLUTION RIEF FORTINET AND SERVICENOW INTEGRATED SECURITY SOLUTION Integrated NOC-SOC Solution to Automate IT Processes and Security Response

NOC-centric security of reconfigurable SoC - Lab …gogniat/papers/diguetnoc2007.pdfNOC-centric security of reconfigurable SoC Jean-Philippe Diguet, Samuel Evain, Romain Vaslin,

Introduction NoC Concept Network-on-Chip … NoC Concept NoC topology Switching strategies Routing algorithms Flow control schemes NoC Architecture Examples ... paradigm for System-on-Chip

Noc Router1PPT

Introduction NOC

3M DI-NOC Filmmultimedia.3m.com/mws/media/486419O/di-noc-website.pdf · 3M™ DI NOC™ Film DI-NOC Features: DI-NOC has been developed as a high class decorative wall covering for

Colorado State University1 Subnet Managers Meeting 3/11/09 NOC update – Redder NOC update – Redder Security update – Lovaas Security update – Lovaas Student

ONGOING PERSONNEL SECURITY - CPNI...effective ongoing personnel security measures will help to mitigate the insider threat, and should include: a strong security culture, where everyone

How To Identify And Mitigate Security And Intellectual Property Risks When Outsourcing Offshore

NOC Services

Prepare your NOC 111. SP’s/ISP’s NOC Team Every SP and ISP needs a NOC Anyone who has worked or run a NOC has their own list of what should be in a NOC

21c3 NOC Overview - blackwingblackwing.de › files › vortraege › 2004_12-21c3-NOC_Overview.pdf · The 21c3 NOC Crew, January 9, 2005 21c3 NOC Overview - p. 1/18 21c3 NOC Overview

GAO-06-1090T Border Security: Stronger Actions Needed to Assess and Mitigate Risks … · 7GAO, Border Security: Stronger Actions Needed to Assess and Mitigate Risks of the Visa Waiver

Evolutionfarm NOC

VMware vCloud Security - packtpub.com · VMware vCloud Security. Welcome to VMware vCloud Security. In this book, you will learn how to mitigate the security threats on a private

Security Bootcamp 2013 - Mitigate DDoS attack with effective cost - Nguyễn Chấn Việt

Module 11: Switch Security ConfigurationModule Objective: Configure switch security to mitigate LAN attacks Topic Title Topic Objective Implement Port Security Implement port security

OHSSE NOC APPLICATION - dqpgtzxn0wn4l.cloudfront.netdqpgtzxn0wn4l.cloudfront.net/docs/LPD/HSSE+NOC+Application.pdf · ohsse noc application ds.ohsse.p.corp.06.noc.f01 rev.0, july

How to Mitigate threats and Ensure Robust Security for Remote Workers in public Wi-Fi

Social Security Administration Security Administration 2011 Annual FISMA ... For the incidents above detected by NOC/SOC during penetration testing provide the following information:

Noc Monitoring

Revised 1/14/2008 - PA - eMarketplace Web viewSupplier’s perimeter security and network operations alerting and NOC/SOC services interfaced to enterprise NOC/SOC services that are