Upload File

the inevitable cyber attack: from observation to …...analytics soc implementation methodology soc...

  • Home
  • Documents
  • The Inevitable Cyber Attack: From Observation to …...Analytics SOC Implementation Methodology SOC FOCUS Threat Monitoring and Operations Threat Protection Intelligence & Incident
22
Presenter Date 27 June 2018 Jon Hamlet – Senior Country Manager The Inevitable Cyber Attack: From Observation to Remedial Action and Minimizing Dwell Time” In- between

Upload: others

Post on 30-Aug-2020

0 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: The Inevitable Cyber Attack: From Observation to …...Analytics SOC Implementation Methodology SOC FOCUS Threat Monitoring and Operations Threat Protection Intelligence & Incident

Presenter

Date

27 June 2018

Jon Hamlet – Senior Country Manager

The Inevitable Cyber Attack: From Observation to Remedial Action and Minimizing Dwell Time” In-between

Page 2: The Inevitable Cyber Attack: From Observation to …...Analytics SOC Implementation Methodology SOC FOCUS Threat Monitoring and Operations Threat Protection Intelligence & Incident

Haider Pasha, CISSP, C|EHChief Technology Officer

Emerging Markets

A Security Operations Center is a Highly Skilled team following Well-Defined Definitions and Processes to Manage

Threats and Reduce Security Risk

Page 3: The Inevitable Cyber Attack: From Observation to …...Analytics SOC Implementation Methodology SOC FOCUS Threat Monitoring and Operations Threat Protection Intelligence & Incident

3Copyright © 2017 Symantec Corporation

Secu

rity

Ope

ratio

ns C

ente

r

CONCERNS

Data Protection & Compliance

Scaling for Growth

Limited Cyber Security Threat Intelligence &

Analytics

SOC Implementation Methodology

SOC FOCUS

Threat Monitoring and Operations

Threat Protection

Intelligence & Incident Response

Security Analytics

Key Security Challenges

REQUIREMENTS

Enhancing Visibility

Outsource vs. Co-Source of Security Operations

Governance & Control

Proactive Threat Detection, Prevention, &

Response

Page 4: The Inevitable Cyber Attack: From Observation to …...Analytics SOC Implementation Methodology SOC FOCUS Threat Monitoring and Operations Threat Protection Intelligence & Incident

4Copyright © 2017 Symantec Corporation 4

Th

rea

t Pro

tectio

n SOC

Ma

turi

ty

SOC

Inte

llig

en

ce DE

FEN

SE

SOC Vision

Proactive Protection

Incident Response

Security Advisory

Reporting and SLAs

Incident Management

Big Data Analytics

Managed Security Service

Simulation Services

Network Protection

Threat Intelligence

Vulnerability Assessments

SIEM

IT-GRC

Enhanced Visibility

Page 5: The Inevitable Cyber Attack: From Observation to …...Analytics SOC Implementation Methodology SOC FOCUS Threat Monitoring and Operations Threat Protection Intelligence & Incident

5Copyright © 2017 Symantec Corporation

Security Management Consideration

5

CostHigh CAPEX

Variable OPEX

ControlInternal Team Knows Environment

Potentially Most EfficientComplex to Manage

TimePeople Recruitment, Tools Procurement &

Configuration

StaffHard to Acquire, Retain, Train

RiskHigh Risk – Mitigated with Augmentation

Assigned to End-User

CostLow CAPEX

Predictive OPEX

ControlLack of Environment Knowledge by 3rd Party

SLA Based ServicesDifficult to Terminate / Change

TimeHandover, Service Definition and SLA

Measurement

Staff3rd Party Responsibility

RiskMedium Risk

Assigned to the Provider

CostModerate CAPEXPredictive OPEX

ControlBenefits of Local Knowledge and 3rd Party

ExpertisePartial SLA Service

Flexible Future Change

TimeBlended Approach

StaffStaff Augmentation

RiskLowest Risk;

Shared Between Companies

Co-sourcingOutsourcingInsourcing

Page 6: The Inevitable Cyber Attack: From Observation to …...Analytics SOC Implementation Methodology SOC FOCUS Threat Monitoring and Operations Threat Protection Intelligence & Incident

6Copyright © 2017 Symantec Corporation

Process

Page 7: The Inevitable Cyber Attack: From Observation to …...Analytics SOC Implementation Methodology SOC FOCUS Threat Monitoring and Operations Threat Protection Intelligence & Incident

7Copyright © 2017 Symantec Corporation

Res

po

nse

SOC Framework Best PracticeD

etec

t

Incident Threat Forensic Vulnerabilities Assurance (SLA)

Security Incident Monitoring

Incident Management

Threat Monitoring

Threat Management

Security Analysis

CERT

Availability and Performance Monitoring

IR SLAPatchManagment

VulnerabilityMonitoring

Prev

ent

Incident Simulation

Intelligence Integration

Risk Management Security Awareness

Penetration Testing

Page 8: The Inevitable Cyber Attack: From Observation to …...Analytics SOC Implementation Methodology SOC FOCUS Threat Monitoring and Operations Threat Protection Intelligence & Incident

8Copyright © 2017 Symantec Corporation

Log Monitoring

Event Detection

Incident Response

Proactive Prevention

Predictive Protection

Security Management

SOC

Analyze Security Systems logs for any security threats and take proper action accordingly

Conduct health-check and preventive maintenance for all security systems

Perform Change & Configuration Management through RFC&MDT process

Implement new Security Policy on the managed devices following the agreed process

Provide 1st & 2nd level of support for the security incidents

Supporting other Security departments during the incident handling process

SOC Methodology

Page 9: The Inevitable Cyber Attack: From Observation to …...Analytics SOC Implementation Methodology SOC FOCUS Threat Monitoring and Operations Threat Protection Intelligence & Incident

9Copyright © 2017 Symantec Corporation 9

Mon

itorin

gAd

viso

ryM

anag

ingReactive Services Proactive Services Security Management

Security Monitoring

Event Monitoring

Event Correlation

Incident Management

Incident Response

Incident Triage

Malware & Forensics AnalysisIncident Recovery & Post Mortem

Vulnerability Management

Real-Time Device Monitoring

V A /PT & Threat M odel S im ulations

Security & Compliance Audit

Cyber Threat Intelligence

Threat Hunting & Analysis

Honey potting

Performance & Fault Monitoring

Incident Notification

Reporting

Alerting & Warning

Trending

Technical Reports

Policy & Device Management

Secure Device Configuration

Policy Enforcement

Patch Management

Business Impact Analysis

Risk Assessment

Threat Assessment

Technology Watch

Security Consulting

Awareness

Countermeasure SelectionExecutive Reporting

Risk Management

Business Continuity

Asset Inventory

Policy Planning

Security Hotline

Security Governance

Personnel & Supplier M anagem ent

Events Data Retention

Hardening

Education & Training

Certification

Inventory Scanning

Threat & Vulnerability

Triage

Patch & Vulnerability Governance

Operational & Strategic Threat

Reports

SOC Service Catalog “Define your security services menu”

Page 10: The Inevitable Cyber Attack: From Observation to …...Analytics SOC Implementation Methodology SOC FOCUS Threat Monitoring and Operations Threat Protection Intelligence & Incident

10Copyright © 2017 Symantec Corporation

Monitoring

Monitoring

Monitoring

A Simplified View

10

Data

Apps Cloud

Data Center

Endpoints

Network

FW N DIS

Proxy W AF

Endpoint Security

HIDS

DLP

M ail Security

DLP

Identity

Security Operations

Center

First SOC function: Monitoring

Bring visibility to current security issues

Real-time Device MonitoringIncident Detection

Incident Classification

Page 11: The Inevitable Cyber Attack: From Observation to …...Analytics SOC Implementation Methodology SOC FOCUS Threat Monitoring and Operations Threat Protection Intelligence & Incident

11Copyright © 2017 Symantec Corporation

Managing

Managing

Managing

A Simplified View

11

Data

Apps Cloud

Data Center

Endpoints

Network

FW N DIS

Proxy W AF

Endpoint Security

HIDS

DLP

M ail Security

DLP

Identity

Security Operations

Center

Second SOC function: Managing

Policy ManagementPolicy Enforcement

Incident RemediationManaged Network Security

Managed EndpointManaged Messaging

Advanced Threat ProtectionRisk ManagementCyber Resilience

Page 12: The Inevitable Cyber Attack: From Observation to …...Analytics SOC Implementation Methodology SOC FOCUS Threat Monitoring and Operations Threat Protection Intelligence & Incident

12Copyright © 2017 Symantec Corporation

A Simplified View

12

Data

Apps Cloud

Data Center

Endpoints

Network

FW N DIS

Proxy W AF

Endpoint Security

HIDS

DLP

M ail Security

DLP

Identity

Re

po

rti

ng

Aler

t and

war

ning

Executive

Executive

Cyber

Insurance

IT

Third SOC function: Advisory

Alerting and WarningTechnical and executive

reportingCompliance Reporting

Cyber Insurance

Security Operations

Center

Page 13: The Inevitable Cyber Attack: From Observation to …...Analytics SOC Implementation Methodology SOC FOCUS Threat Monitoring and Operations Threat Protection Intelligence & Incident

13Copyright © 2017 Symantec Corporation

Incident Response Process Framework

13

ProcessStages

ScopePreventative &

Detective Controls

IR Plans & Team Training

Detection & AnalysisPreparation Containment, Eradication, & Recovery Post-Incident Activities

IR Technologies & Partners

Event Monitoring &

Analysis

Triage & Document

IncidentIncident

NotificationEvidence

Collection & Analysis

Incident Scope & Containment

Strategy

Mitigation, Recovery, & Verification

Incident Reporting &

Lessons Learned

Remedial Actions

Evidence Archival

SolutionAreas

• IR Plan & Program Development

• Penetration Testing• Risk Assessments

• Security Monitoring Health Checks

• IR Retainer Services

• IR “Blue Team” Simulations• Security Program

Assessments

• Managed Security Services

• APT Discovery Services• Malicious Activity

Assessments

• Incident Response Services

• System Forensics

• Network Forensics• Log Analysis / MSS

• Memory Forensics• Advanced Malware Analysis

• Intelligence Services• Advanced Threat Protection

Solutions

• Incident Response Services

• Incident Response Services

• Enablement Services• Partner-led Remediation

Services

• Partner-led Litigation Support

SpecialtyAreas Security Intelligence | Advanced Threat Protection | Advanced Malware Analysis | Global Operations

Page 14: The Inevitable Cyber Attack: From Observation to …...Analytics SOC Implementation Methodology SOC FOCUS Threat Monitoring and Operations Threat Protection Intelligence & Incident

14Copyright © 2017 Symantec Corporation

Incident Handling Methodology

14

Preperation

Detection

Assessment (Triage)

Analysis

Notification

Response

Closure

Page 15: The Inevitable Cyber Attack: From Observation to …...Analytics SOC Implementation Methodology SOC FOCUS Threat Monitoring and Operations Threat Protection Intelligence & Incident

15Copyright © 2017 Symantec Corporation

People

Page 16: The Inevitable Cyber Attack: From Observation to …...Analytics SOC Implementation Methodology SOC FOCUS Threat Monitoring and Operations Threat Protection Intelligence & Incident

16Copyright © 2017 Symantec Corporation

Security Monitoring team shift AL2 Senior AnalystL1 Junior Analyst

Security Monitoring team shift BL2 Senior AnalystL1 Junior Analyst

Security Monitoring team shift CL2 Senior AnalystL1 Junior Analyst

22:00 6:00 14:00 22:008:00 12:00 20:0016:00

Security Monitoring team shift DL2 Senior AnalystL1 Junior Analyst

Cyber Security Team - L3 Analyst Cyber Security Team - L3 Analyst

UAM & CR Management Team UAM & CR Management Team

Shift team in rest

SOC Governance and Management

SOC Service Delivery ManagerSOC Manager

SOC Quality Control Team

PEOPLE: 24/7 SOC Shift ExampleM

onito

ring

Adm

inist

ratio

n -Op

erat

ion

Admin & Operation team Senior/Junior System Admin

Senior/Junior Network Admin

Vuln & Threat Management Team Vuln & Threat Management Team

Admin & Operation team Senior/Junior System Admin

Senior/Junior Network Admin

Security Analytics Team –Admin&Op

Security Analytics Team –Admin&Op

Page 17: The Inevitable Cyber Attack: From Observation to …...Analytics SOC Implementation Methodology SOC FOCUS Threat Monitoring and Operations Threat Protection Intelligence & Incident

17Copyright © 2017 Symantec Corporation

Security Operation team

SOC Manager

Reporting and Quality control team

Security analytics team

User access management and Operational CR assessment

Vulnerability and Threat Management Team

Cyber security Intelligence team

Security Monitoring and operations Infrastructure

Security monitoring team

Security monitoring team manager

Shift A(L1+L2+ Shift leader)

Shift B(L1+L2+ Shift leader)

Shift C(L1+L2+ Shift leader)

Shift D(L1+L2+ Shift leader)

Security Operation team manager

Cyber Intelligence team manager

Threat&Vulnerability manager

SOC Service Delivery Manager

Big Data Platform Management team

Big Data Platform Analyst team

Typical SOC Team Structure

Page 18: The Inevitable Cyber Attack: From Observation to …...Analytics SOC Implementation Methodology SOC FOCUS Threat Monitoring and Operations Threat Protection Intelligence & Incident

18Copyright © 2017 Symantec Corporation

Technology

Page 19: The Inevitable Cyber Attack: From Observation to …...Analytics SOC Implementation Methodology SOC FOCUS Threat Monitoring and Operations Threat Protection Intelligence & Incident

19Copyright © 2017 Symantec Corporation

Endpoint Protection

• Remediation • Isolation • Investigation

Global Intelligence

SOC: Incident Response Function

- Automated Incident Creation and Correlation

- Detection of Suspicious Events- Prioritization of Incidents- Event Enrichment

SOC: Threat Intelligence Team

• Threat Hunting• Automated IOC searching

Route high severity incidents directly to the SOC

Web Security Service/Gateway

IT Helpdesk

Sandbox

Network

EndpointPlatform

Email

Web

Corre lation

Attribution

Sandbox

Single ConsoleSO C W orkbench

ü V isib ility

ü Controlü A ssurance

Monitored Security Services

IncidentResponse

Data Protection Connector

Integrated Threat Protection: SOC Workbench

- Who’s attacking us

- What TTP are used and IOC - Campaign and Adversary

Intelligence - Enterprise Visibility

Security Analytics

Email Security Service/Gateway

Page 20: The Inevitable Cyber Attack: From Observation to …...Analytics SOC Implementation Methodology SOC FOCUS Threat Monitoring and Operations Threat Protection Intelligence & Incident

20Copyright © 2017 Symantec Corporation

Endpoint • Remediation • Investigation

Email

EndpointPlatform

WebStorage

Data Protection: Incident Response Function

- Automated Incident Creation- Universal policy deployment- Single enforce platform

Data Protection Connector

Data at Rest

Single D ata Protection Consoleü V isib ilityü Controlü A ssurance

Web Proxy

v

Web &Internet

Corporate SaaS Apps Email

Tagging & Encryption

Identity & Authentication

Shadow IT Visibility & Control

Integrated Information Protection Controls

IT HelpdeskCASB

Integrated Information Protection: SOC WorkbenchEmail Security

Service (SMTP)

Page 21: The Inevitable Cyber Attack: From Observation to …...Analytics SOC Implementation Methodology SOC FOCUS Threat Monitoring and Operations Threat Protection Intelligence & Incident

21Copyright © 2017 Symantec Corporation

Few takeaways

o Each SOC project is a journey. Get the required buy in.o Projects require a considerable amount of time and money.

o Hybrid approach can massively speed up the time to service delivery.o Consider adopting an MSSP even as a temporary solution

o Define Service Catalog Carefully.o Implement baby steps: do few things well.

o Do not oversell SOC mission and implement the basics right.o Do not ingest any data: clearly define your use cases.oGet the right staff in place.

o Motivate them, motivate them, motivate them.

Page 22: The Inevitable Cyber Attack: From Observation to …...Analytics SOC Implementation Methodology SOC FOCUS Threat Monitoring and Operations Threat Protection Intelligence & Incident

22Copyright © 2017 Symantec Corporation 22Copyright © 2017 Symantec Corporation


The inevitable shift towards building information ... · THE INEVITABLE SHIFT TOWARDS BUILDING INFORMATION ... The Inevitable Shift Towards Building Information Modelling (BIM)

Doctrine of Inevitable Disclosure

5G/SOC: Inside the world’s most advanced SOCsh41382. · Security Operations Center (SOC) Threat Operations Center (TOC) Security Defense Center (SDC) ... Splunk kaggle . Parse ScaleXtreme

Cyber Threat Intelligence, the key to the SOC of the Future · Threat Intelligence can… •Give you a rich source of IOCs to block •Help you better understand emerging threats

e2e Cloud Protective Monitoring and SOC Service - … · SOC Service - Service Definition Document . ... business service driven, ... Single holistic view of risk and threat across

IS MINORITY REPORT INEVITABLE ?

Automated Response in Cyber Security SOC with Actionable ... · 1. Using the global threat intelligence cloud Malware Signature (1Billions) C&C/DNS Signature (Million) Threat IntelligenceCloud

Bulding Soc In Changing Threat Landscapefinal

ANTICIPATING THE “INEVITABLE WAR”

ADVANCED THREAT INTELLIGENCE - Bitdefender · Advanced Threat Intelligence Architecture Advanced Threat Intelligence resolves a long-standing blind spot for SOC managers and analysts,

Pretty Good SOC - .conf2017 | The 8th Annual Splunk ... · Pretty Good SOC Effectively ... TransAlta Overview ... (Varonis) Advanced Threat Protection (FireEye, Palo Alto) Cloud Services

Restructuring in FICC Inevitable

Откуда и какие брать данные Threat Intelligence для SOC?

ss When casting becomes inevitable ??universe.bits-pilani.ac.in/uploads/CHAPTER2 -CASTING.pdf · When casting becomes inevitable ??

2009 Inevitable Surprises

Inevitable Consequences

The State of the SOC - ACE Pac · 4. Threat hunting is an elite operation that exists only in the largest and most sophisticated organizations . Threat hunting is a recent innovation

HOW TO BUILD A SOC WITH LIMITED RESOURCES · HOW TO IL A SOC WITH LIMITE RESORCES PAGE 5 Threat Lifecycle Management Basics Threat Lifecycle Management is the key to detecting and

SoC FPGA Hardware Security Requirements and Roadmap · 2 Agenda •Security Threat Models for FPGA/SoC FPGA End Markets •Taxonomy of Security Threats •Threat Use Cases •Overall

THE EXPLODING SYNESTHESIC INEVITABLE

SECURITY OPERATION CENTER - ejlas14.irib.ir Presentation (1).pdf · Tier 1 (Run) Senior Threat Analyst Threat Analyst Threat Analyst Trainee SOC Triage Tier 2 (Run) Senior Threat

Inevitable - J#2)

Change is Inevitable

INCONTINENCE shouldn’t be inevitable

Inevitable Desastre

Team Inevitable!

Hastening the Inevitable

The Inevitable Confliot

GM: Contemptible or Inevitable

BSides Zurich 17.09.2016 Advanced Detection using Sysmon€¦ · Tom Ueltschi Swiss Post CERT / SOC / CSIRT, since 2007 –Focus: Malware Analysis, Threat Intel, Threat Hunting, Red

Is Economic Ruin Inevitable?

Test Automation is inevitable

santantimo.etrasparenza.it · 19) soc. 20) soc. 21) soc. 22) soc. 23) soc. 24) soc. 25) soc. 26) soc. 27) soc. 28) soc. 29) soc. 30) soc. GI.TA.SI. SRL; STP SRL, DE CHIARA COSTRUZIONI

 · 0016/soc/soc/11-12 krushna chandra sahoo 16 0005/soc/soc/11-12 lipsa nanda 17 0007/soc/soc/11-12 truptimayee behera 18 0045/soc ... 0064/soc/soc/11-12 dayanidhi deep 27 sc 0009/soc/soc/11-12

The Inevitable Cloud Outage