Advanced SOC. Key Technologies for Security Operations. RSA Security Summit 2014 Advanced SOC. RSA Security Summit, 24 april 2014 Marcel Knippen

Transcription

1

2 Advanced SOC Key Technologies for Security Operations RSA Security Summit, 24 april 2014 Marcel Knippen IT Security Experts Onsight External Use 2

3 Agenda Intro Onsight What s the need for an advanced SOC Define your goal The adaptive security model Challenges People, Processes & Technology IT Security Experts Onsight External Use 3

4 Intro Onsight Since 1999, 100% focus on IT Security Security for Enterprises Security Operations & Monitoring Security Solutions Delivery Committed to Customer Satisfaction Dutch company, 70 employees Security Operations Center ISAE 3402, ISO IT Security Experts Onsight External Use 4

5 What s the need for an advanced SOC Closed networks are transforming to open environments Fading borders: physical, ownership, responsibility, geographical IT becomes critical to business success Cost of threat impact is rising Management responsibility Incidents are occurring more and more Existing prevention capabilities are getting less effective Governance, Risk and Compliance IT Security Experts Onsight External Use 5

6 What s the need for an advanced SOC Incidents might occur reactive ad hoc Incident response Incidents will occur proactive process Continuous response IT Security Experts Onsight External Use 6

7 Define your goal What do you expect from your SOC? IT Security Experts Onsight External Use 7

8 IT Security Experts Onsight External Use 8

9 Clearly define your goal It s easy to get lost Average customer generates logs per day events per day. and growing Top down approach Start with (a subset of) management committed standards Clearly define the deliverables IT Security Experts Onsight External Use 9

10 Adaptive security model Foundation for the advanced SOC IT Security Experts Onsight External Use 10

11 Proactive security Exposure Predict Baseline Remediate Change Investigate Continuous Monitoring and Analyzing Isolate Divert Prevent Detect Prioritize Contain breach IT Security Experts Onsight External Use 11

12 Security resources: People and technology IT Security Experts Onsight External Use 12

13 Baseline systems Continuous re-baselining Discovery of devices, systems, services, identities, vulnerabilities,.. Predict attacks Understand the Attack Workflow Proactive exposure analyses New devices, applications and services come and go Are compensating controls needed? IT Security Experts Onsight External Use 13

14 故曰 : 知彼知己, 百戰不殆 ; 不知彼而知己, 一勝一負 ; 不知彼, 不知己, 每戰必殆 If you know your enemies and know yourself, you can win a hundred battles without a single loss. Sun Tzu, The Art of War IT Security Experts Onsight External Use 14

15 Know your enemy : Cyber Threats Agents (Attackers) Corporations Nation States Hacktivists Cyber Terrorists Cyber Criminals Cyber Fighters Script Kiddies Online Social Hackers Employees IT Security Experts Onsight External Use 15

16 Know their weapons: Top 10 Cyber Threats 1. Drive-by Downloads 2. Malicious Code: Worms/Trojans 3. Code Injection 4. Exploit Kits 5. Botnets 6. Physical Damage/Theft/Loss of media 7. Identity Theft/Fraud 8. Denial of Service 9. Data Breaches 10. Targeted Attacks Threat Landscape 2013 IT Security Experts Onsight External Use 16

17 Know how they operate? Attack Workflow Drive-by downloads Worms/Trojans IT Security Experts Onsight External Use 17

18 不知彼而知己 And know yourself Exposure Vulnerabilities Measures Assets Controls IT Security Experts Onsight External Use 18

19 Probability RSA Security Summit 2014 Advanced SOC Know yourself: Domain, Risk, Business Impact IT Domains - Critical Infrastructure - Cloud computing - Social Networking - E-commerce - Mobility - Office workplace - Trusted Infrastructure - Internet of things -. Impact IT Security Experts Onsight External Use 19

20 Isolate systems Reduce the attack surface Harden and segment (sub-)systems Default deny approach Firewall, App Control,, multi-layered Divert Attackers Gain time and knowledge Honeypots, Stealth layers,.. Prevent Incidents On Network, System, Application level Signature & behavioral prevention IT Security Experts Onsight External Use 20

21 Detect Incidents Shorten time to limit damage and loss of information Anomalies from normal patterns of behavior Connections from/to know bad entities Continuous Analytics Prioritize Risk Confirm risk with internal/external context Prioritize by risk to the enterprise Contain Incidents Isolate compromised systems, accounts,.. Prevent further incidents using same method IT Security Experts Onsight External Use 21

22 Investigate/Forensics Forensics, root cause and full scope analyses Retrospective analyses (motivation, what happened) Analyses of historical data with new insights Design/Model Change Prevent new attacks or reinfection of systems Design changes of policies or controls Remediate/Make change Implementation of change Enforcement of new policies and controls into firewall, IPS, Applications, network,. IT Security Experts Onsight External Use 22

23 Onsight SensorNet Continuous monitoring of customer s IT assets Systems, Apps, Users, Packets, Data, Flows,. Security Intelligence using visibility and real-time correlation (OSIX) Onsight SOC Multi-Domain SOC MSS Onsight DCs Collector + Sensor Collector + Sensor Collector + Sensor Mngmnt Customers Sensor Sensor Sensor Sensor FW, IDS,.. Customer A B C IT Security Experts Onsight External Use 24

24 Onsight SensorNet Asset Discovery Vulnerability Assessment Threat Detection Behavioral Monitoring Packet Capturing Log Collection IT Security Experts Onsight External Use 25

25 Onsight Security Intelligence exchange OSIX Threat Intelligence Signatures, Correlation Rules, Emerging Threats Community Intelligence OTX, IP reputation, Vendor Labs: RSA, Security Information: Advisories, News, NCSC, SANS,.. Vulnerability Information CVE, Zero-day,.. Context : GeoIP, Date, User, IT Security Experts Onsight External Use 26

26 Challenges People, Processes & Technology IT Security Experts Onsight External Use 28

27 Challenges People Authority and mandate Multiple disciplines/roles, limited resources Motivation and commitment Skills, experience and knowledge Organization: Career, position and salary Security clearance and background checks Communication skills (technical to business) IT Security Experts Onsight External Use 29

28 Challenges People IT Security Experts Onsight External Use 30

29 Challenges Processes Standards and processes Incident Response Continuous Response Integration of SOC processes into business processes Responsibility, authority and commitment Both technical and communication protocols Strict procedures versus flexibility Lenghty procedures versus fast response Innovation (Onsight Labs) IT Security Experts Onsight External Use 31

30 Challenges Processes Operational Analytical Business & Technology Call out Case Management Event Handling Monitoring On-boarding Shift Log Shift Turn Over Triage Event Analysis Incident Response Reporting Research Threat Intelligence Access Management Architecture Compliance DR/BCP Process Improvement Use Cases IT Security Experts Onsight External Use 32

31 Challenges Technology Tooling needed for monitoring, reporting, alarms, tickets, triage and forensics Integrate tooling with external security data Management of tooling (functional and technical) Big Data analytics IT Security Experts Onsight External Use 33

32 Challenges Other Defining business value of IT assets Legal challenges (privacy,..) Knowledge transfer Legacy aspects Interfacing to the business Budget versus investments, ROI Innovation of all layers IT Security Experts Onsight External Use 34

33 Challenges SOC as a Service Trust Expectations Connecting the service to your processes Responsibility and mandate Outsource your SOC does not outsource your responsibility Teamwork and commitment Management and coordination IT Security Experts Onsight External Use 35

34 Enterprise SOC or SOC as a Service IT Security Experts Onsight External Use 36

35 Thank you! Any questions? IT Security Experts Onsight External Use 38

36 IT Security Experts Onsight External Use 39