Extending Network Visibility: Down to the Endpoint
Denunciar
Lancope, Inc.Seguir
18 de Jun de 2015•0 gostou•645 visualizações
Extending Network Visibility: Down to the Endpoint
18 de Jun de 2015•0 gostou•645 visualizações
Baixar para ler offline
Denunciar
In today’s world of constantly evolving security threats and attack vectors, organizations need to be vigilant about monitoring their network infrastructure. The network perimeter and security infrastructure is often challenged with the adoption of mobile devices, cloud, and BYOD policies. The need for visibility into endpoint activity has become more important than ever. Join Josh Applebaum (Ziften), Matthew Frederickson, (Council Rock School District) and Peter Johnson (Lancope) for a complimentary webinar to learn how you can achieve real-time network visibility and intelligence for improved incident response. Discover how you can: - Achieve additional visibility and context to network activity - Enhance your existing security investments (NetFlow, Firewall, SIEM, threat intelligence) - Improve incident response by obtaining real-time and historical endpoint data
Lancope, Inc.Seguir
Recomendados
Detecting Threats: A Look at the Verizon DBIR and StealthWatchLancope, Inc.
Combating Insider Threats – Protecting Your Agency from the Inside OutLancope, Inc.
Save Your Network – Protecting Manufacturing Data from Deadly BreachesLancope, Inc.
So You Want a Threat Intelligence Function (But Were Afraid to Ask)Lancope, Inc.
Supply Chain Attack Backdooring Your Networks Bangladesh Network Operators Group
Insider threats webinar 01.28.15Lancope, Inc.
Mais conteúdo relacionado
Mais procurados
IoT - the Next Wave of DDoS Threat LandscapeAPNIC
What Happens Before the Kill Chain OpenDNS
Infoblox - turning DNS from security target to security toolJisc
BSidesLV 2018 - Katie Nickels and John Wunder - ATT&CKing the Status QuoKatie Nickels
SOPHOS presentation used during the SWITCHPOINT NV/SA Quarterly Experience Da...SWITCHPOINT NV/SA
Defense in Depth: Implementing a Layered Privileged Password Security Strategy BeyondTrust
Destaque
StackOverflowSusam Pal
The Seven Deadly Sins of Incident ResponseLancope, Inc.
SCADA Security: The Five Stages of Cyber GriefLancope, Inc.
Top 10 Security Vulnerabilities (2006)Susam Pal
Cisco Threat Defense (Cisco Stealthwatch)Cisco Russia
StealthWatch & Point-of-Sale (POS) Malware Lancope, Inc.
Similar a Extending Network Visibility: Down to the Endpoint
Behind the Curtain: Exposing Advanced ThreatsCisco Canada
Next Generation SecurityCisco Canada
Using NetFlow to Streamline Security Analysis and Response to Cyber ThreatsEmulex Corporation
The Next Generation SecurityCybera Inc.
CONFidence2015: Real World Threat Hunting - Martin NystromPROIDEA
Reacting to Advanced, Unknown Attacks in Real-Time with LastlineLastline, Inc.
![[CONFidence 2016] Gaweł Mikołajczyk - Making sense out of the Security Operat...](https://cdn.slidesharecdn.com/ss_thumbnails/gawemikoajczyk-makingsenseoutofthesecurityoperations-160601113717-thumbnail.jpg?width=1600&height=908&fit=bounds)
Mais de Lancope, Inc.
Solving the Visibility Gap for Effective SecurityLancope, Inc.
Save Your Network – Protecting Healthcare Data from Deadly BreachesLancope, Inc.
Protecting the Crown Jewels from Devastating Data BreachesLancope, Inc.
The Library of SpartaLancope, Inc.
Looking for the weird webinar 09.24.14Lancope, Inc.
Protecting Financial Networks from Cyber CrimeLancope, Inc.
Extending Network Visibility: Down to the Endpoint
- 1. © 2015 Lancope, Inc. All rights reserved. Extending Network Visibility: Down to the Endpoint Peter Johnson, Technical Alliances Engineer (Lancope) Josh Applebaum, Director of Product Marketing (Ziften) Matthew Frederickson, Director of Information Technology (CRSD)
- 2. © 2015 Lancope, Inc. All rights reserved. 2 Good vs. Evil: The Other Side is Always Innovating Evolution of conflict/threats Requires constant innovation from practitioners and vendors to combat this
- 3. © 2015 Lancope, Inc. All rights reserved. 3 The Evolution of Cyber Threats Viruses (1990s) Worms(2000s) Defense: Reputation, DLP, App.-aware Firewalls Botnets (late 2000s to current) Strategy: Visibility and Context Directed Attacks (APTs) (today) I LOVE YOU Melissa Anna Kournikova Nimda SQL Slammer Conficker Tedroo Rustock Conficker Aurora Shady Rat Duqu Heartbleed Cryptolocker Defense: Anti-Virus, Firewalls Defense: Intrusion Detection & Prevention
- 4. © 2015 Lancope, Inc. All rights reserved. 4 The Problems Customers Face FW IPS IDS James Comey, FBI Director: “There are two kinds of big companies in the United States. There are those who’ve been hacked…and those who don’t know they’ve been hacked.” 209 days before attackers were discovered 783 incidents & hundreds of millions of compromised records $3.5M is the average lost business cost of a breach Customer Impact External Internal
- 5. © 2015 Lancope, Inc. All rights reserved. 5 Flow Data - A Light in the Darkness • Low cost monitoring solution • Uses outputs from existing infrastructure • Single or small number of regional collectors support an infrastructure • Easy to configure • Enabled on the devices • No hardware to insert • Broad presence already in the networks • Routers • Switches • Firewalls, etc… • Accounting data stores well • Fractions of a percentage of storage needed for Packet Capture • Common format means it’s easy to write to tables for analysis
- 6. © 2015 Lancope, Inc. All rights reserved. 6 Detailed Visibility Drilling into a single flow provides a wealth of information
- 7. © 2015 Lancope, Inc. All rights reserved. 7 Behavior Analysis
- 8. © 2015 Lancope, Inc. All rights reserved. 8 Two Halves of the Puzzle Real Time Detection: StealthWatch consumes data from devices all over the network and through a mix of policy and behavioral knowledge identifies threats that move past the traditional methods of detection. Incident Response: StealthWatch allows operators to move quickly from a singular event to understanding the full context of what is known about network activity from that host. How they communicated and with whom, while quickly detailing any additional points of concern.
- 9. © 2015 Lancope, Inc. All rights reserved. 9 Stop Problems Before They Are Crisis ImpacttotheBusiness($) credit card data compromised attack identified vulnerability closed attack thwarted early warning attack identified vulnerability closed attack onset STEALTHWATCH REDUCES MTTK Company with StealthWatch Company with Legacy Monitoring Tools ~70% of Incident Response is spent on MTTK “Worm outbreaks impact revenue by up to $250k / hour. StealthWatch pays for itself in 30 minutes.” F500 Media Conglomerate 259% ROI MTTK Time
- 10. © 2015 Lancope, Inc. All rights reserved. StealthWatch 6.7 Pivot to Ziften 10
- 11. © 2015 Lancope, Inc. All rights reserved. Continuous Endpoint Visibility
- 12. © 2015 Lancope, Inc. All rights reserved. Council Rock School District Matthew Frederickson, Director of Information Technology
- 13. © 2015 Lancope, Inc. All rights reserved. Overview • 11,200 students • 1,300 staff • 12th largest out of 500 in Pennsylvania • 2 High Schools (grades 9 through 12) • 3 Middle Schools (grades 7 and 8) • 10 Elementary Schools (Kindergarten through 6) • 72 square miles • 10 person IT department
- 14. © 2015 Lancope, Inc. All rights reserved. Network Infrastructure • Microsoft Active Directory • Windows PC/Laptops (5,386) • 1 GB Fiber between buildings • 300 MB Fiber to Internet • Cisco ASA • Cisco 6513 Core Switch • Lightspeed Rocket Content Filter
- 15. © 2015 Lancope, Inc. All rights reserved. Security Concerns 2014 Verizon Databreach Investigations Report
- 16. © 2015 Lancope, Inc. All rights reserved. Integrated Approach • SANS 20 Critical Controls • Now Version 5.1, Council on Cyber Security • Understand WHAT is happening on the network • Lancope StealthWatch – Netflow from BOTH 6513 and ASA • Understand WHY it’s happening • Ziften Desktops – Dashboard, Splunk • Infoblox DDI • Understand Baseline • HS – Alienvault UMS • Cisco IDS • Active Directory • Netwrix • Splunk
- 17. © 2015 Lancope, Inc. All rights reserved. Real World Example • Infoblox DNS Firewall • Top RPZ Hits – 192.168.x.x IP • StealthWatch IP Look • 192.168.x.x – 10.12.2.134 • Ziften • 10.12.2.134 • Running Malware Botnet
- 18. © 2015 Lancope, Inc. All rights reserved. StealthWatch Use Cases 18 Context-Aware Visibility • Network, application and user activity • East-West traffic monitoring • Advanced Persistent Threats • Insider Threat • DDoS • Data Exfiltration • In-depth, flow-based forensic analysis of suspicious incidents • Scalable repository of security information • Application Awareness • Capacity Planning • Performance Monitoring • Troubleshooting • Cisco ISE • Monitor privileged access • Policy enforcement Threat Detection Incident Response Network Diagnostics User Monitoring
- 19. © 2015 Lancope, Inc. All rights reserved. Ziften Use Cases 19 Continuous Monitoring • Endpoint activity • User activity • Network attribution • Indicators of compromise (IOCs) • Custom threat intelligence • Who is patient-zero? • What has changed? • Is there lateral movement? • Endpoint network quarantine • Threat termination • Remediation • Is antivirus running? • OS and application vulnerabilities • Hard drive encryption Real-Time Detection Rapid Forensic Investigation Incident Response Compliance
- 20. © 2015 Lancope, Inc. All rights reserved. Questions? 20
- 21. © 2015 Lancope, Inc. All rights reserved. Thank You! 21 Contact Us: sales@lancope.com sales@ziften.com
Notas do Editor
- Josh to do introductions of everyone presenting on the webinar, brief overview of the webinar topic and agenda, pass over to Peter to start presentation
- Josh: - You can’t predict future attack behaviors – and thus you can’t ignore the unknown. Continuous monitoring and informed visibility is a key aspect of having a secure environment
- Josh: - APT…key word here is “persistent” – attackers will find a way into your environment as their attacks are targeted and the attackers will be very patient and agile when it comes to penetrating your organization’s perimeter Question for Matt (Josh will ask): - QUESTION: “Matt, what are you seeing in your environment at Council Rock School District? Are you seeing a similar threat landscape in your environment? How about insider threats?” - ANWER: (focus in on talking about the insider aspect of your organization, maybe even talk about the students hacking in to the grade system)
- Josh: - In reference to the $3.5M: Nobody wants to be on the front page of the NYT…protecting your reputation is key - Obviously, real-time detection is key, but its also important to be able to review behaviors from the past that may not have seemed suspicious at the time. With average dwell times creeping well over half a year, its important to have the tools in place to be able to investigate and respond to modern day threats
- Josh: - It’s critical to monitor your entire environment, including your endpoints and network. Looking for departures from normal activity patterns is critical for detecting APT’s - Not only monitoring your on-network assets, but also your off-network assets
- Josh: - Question for Peter: “Over the past few years we’ve seen more and more targeted attacks which have bypassed traditional security solutions. Ziften’s view is that traditional blocking prevention solutions such as Antivirus are absolutely necessary, but aren’t sufficient for stopping modern threats. Instead there needs to be more effort put into detection and response solutions. How do you feel about the need to shift from relying on just blocking and prevention solutions?”
- Josh: - I think this is a great point which only re-iterates what we had discussed in the last slide. Since threats will make it into your environment, its imperative that they are detected quickly. Shortening the Mean Time to Know is the most critical aspect of keeping your environment secure. By condensing the time it takes to detect a breach and determine the full scope of it, your security teams are able to spend more time investigating other threats which due to lack of resources, are currently going undetected. - Not only is detection of the threat critical, its also equally as critical to determine the root cause of the breach and design and model changes to your environment in order to prevent future attacks from happening. Without having continuous monitoring solutions in place like Ziften and Lancope, learning from the attack behaviors is nearly impossible.
- Peter to talk about StealthWatch for a moment, discuss the 6.7 release and integration with Ziften around the web lookup pivot; hand off to Josh to move to the next slide and present. Josh will say something like “Let me show you how this works…” which will be the cue to move to the next slide
- Josh: - Its critical to not only continuously monitor your network using a lightweight and scalable solution like Lancope, but its also important to be able to connect the dots from suspicious network behaviors to the endpoints involved. By combining Lancope’s StealthWatch solution with Ziften’s endpoint solution, you are now able to seamlessly extend your visibility from your perimeter, to your network, all the way down into your endpoints. Let me show you how! Cues to click: I’ll say “next you can see…” and stuff like that to indicate the next transition Peter will jump in at the end to wrap up what I said. After Peter wraps things up, I’ll jump in an introduce Matt again and Peter will hand off to him for his slides
- Josh: - Question for Matt: “With such a small security team, do you feel that the time it takes to detect if a suspicious behavior is actually due to a legitimate threats is equally as important as the time it takes to determine that a suspicious behavior is from normal behavior and actually a non-threat?”
- Peter to review Lancope’s use cases
- Josh to review Ziften use cases
- QUESTION: “Are Ziften and Lancope scalable in large environments? I have over 60,000 desktops/laptops and multiple 10’s of thousands of servers.” - **Josh to ask Peter to respond first, then Josh will add in Ziften’s response after - JOSH ANSWER: Ziften was purpose built to be lightweight and scalable. It doesn’t matter how great a solution is on paper, if it doesn’t scale to large environments it eventually become irrelevant. 2) QUESTION: “With all of the new threats on the horizon, how does a security team prioritize what should be looked at?” - **Josh will answer first, then hand off to Peter - JOSH ANSWER: That’s a great question, and I think it really sums up the reason we’re hosting this webinar. Each silo within an organization is going to have their own security solutions, but what is critical is being able to correlate observables across these silos to quickly hone in on the suspect, high priority incidents. In addition, by having integrated solutions like Ziften and Lancope, you’re able to peer deeper than just your endpoint or network on their own, and instead you’re now able to quickly connect the dots to either confirm something is a threat, or move on. 3) QUESTION: “Are you saying that prevention products aren’t necessary? I’m not sure I agree with that statement.” - Josh to answer first, Peter to jump in if he has anything to add, Matt to jump in last if he has anything to add - JOSH ANSWER: Not at all! I know I mentioned something about this earlier in the discussion, but I may have not been totally clear. Blocking and prevention solutions will never go away, and are 100% necessary. What I was trying to emphasize is that the current focus on blocking and prevention is not sufficient. Instead, organizations need to look at expanding their security posture by not only trying to block and prevent incidents by using modern-day solution, but to instead also look at having solutions in place that allow them to quickly detect threats that have slipped through the cracks of existing prevention solutions and be able to efficiently investigate these incidents and quickly respond to them.
- Josh to thank everyone for attending, as well as Peter and Matt for presenting in the webinar Josh to mention that you can contact Ziften and Lancope by emailing us at sales@ziften.com and sales@lancope.com Mention that we can put anyone interested in contact with Matt, and to reach out to either Ziften or Lancope if you want to speak with Matt.