Infosecurity Europe 2016 - Low-friction Security
•Transferir como PPTX, PDF•
2 gostaram•473 visualizações
Piers Wilson from Huntsman Security discusses the problem of "frictional" inefficiencies in cyber security operations. As threats and alerts increase, security teams face growing "workloads" that waste time and resources. Automating threat verification and response can help reduce this "friction" by filtering out false positives, providing diagnostic context to prioritize real threats, and handling basic responses, freeing analysts to focus on more strategic work. The goal is to increase "friction" for attackers while decreasing it for defenders through streamlined, certain, industrial-scale security automation.
Recomendados
Recomendados
Mais conteúdo relacionado
Mais procurados
Mais procurados (20)
Semelhante a Infosecurity Europe 2016 - Low-friction Security
Semelhante a Infosecurity Europe 2016 - Low-friction Security (20)
Mais de Huntsman Security
Mais de Huntsman Security (8)
Último
Último (20)
Infosecurity Europe 2016 - Low-friction Security
- 1. Low Friction Security Piers Wilson Huntsman Security
- 2. Low Friction Security Piers Wilson Huntsman Security
- 3. Introductions Piers Wilson • Head of Product Management • Huntsman Security • piers.wilson@huntsmansecurity.com Cyber security monitoring, security analytics, threat detection and incident management solutions All rights reserved © Tier-3 Pty Limited 2016
- 4. Agenda Why “Low Friction” – the problem The reality of cyber security today Using technology and resources more effectively All rights reserved © Tier-3 Pty Limited 2016
- 5. “Friction” in Security Operations All rights reserved © Tier-3 Pty Limited 2016 Aerodynamicdragincardesign Workloadinsecurityoperations Technology advancements enhance efficiency In security, the advancements have impacted efficiency
- 6. Lowering “friction” Concorde Powerful Aerodynamic shape Very high altitude All rights reserved © Tier-3 Pty Limited 2016 Why? – Air resistance and friction Thin air (altitude) = less resistance, friction Aerodynamic design reduces drag Thrust overcomes drag to achieve speed Drag = Friction = Heat (127o) + Expansion (12”)
- 7. “Operational friction” in security Security teams have to deal with: Increased mass • Alerts/noise/control outputs • The “Weight” & “Force” of threats Increased power • More people “pushing” Inefficient (manual) processes • Un-aerodynamic shapes • Rough surfaces We can waste energy and effort All rights reserved © Tier-3 Pty Limited 2016
- 8. Problem space increasing • IT & Data more complex to control • Continually emerging vulnerabilities • “Security awareness” appetite of users limited • Business cases based on: • Unrealised risks or “prevented” impacts • Illusory / Estimated costs • Regulatory / Reputational impacts growing All rights reserved © Tier-3 Pty Limited 2016
- 9. Technology/Threat Evolution ✗ Trying to add more power / resource ✗ Continually adding more “friction” (security controls) in response to threats ✓ Adopting a “streamlined”, integrated, end-to-end process ✓ Technology that supports operations All rights reserved © Tier-3 Pty Limited 2016
- 10. Automation can help reduce friction • Gather all relevant data • Triage / verify alerts • Optimise end-to-end process • Automate routine tasks • Speed up response • Scalable, repeatable, industrialised Removing / Reducing Impediments All rights reserved © Tier-3 Pty Limited 2016 InputsLogs Threat Intelligence Technical Context Risk Status Organisation information Diagnostic data
- 11. Reducing Friction : Detecting and Verifying
- 12. 1) Automate Verification of Threats Handle massive volume of “detections” Industrial-scale problem that has out-grown manual operation Not just for reports, dashboards or analysis Automate Triage and Diagnostics Need data from all sources Be able to answer questions about an incident or breach Gather relevant data at time of alert All rights reserved © Tier-3 Pty Limited 2016
- 13. Benefits of Automated Verification Rule out false positives quickly • Alerts with no corroborating signs of infection, attack or loss • Reduces “alert queue” by up to 90% Ensure all information provided for “real threats” • Aim to provide certainty Has infection spread? What data lost? Where to ? All rights reserved © Tier-3 Pty Limited 2016
- 15. 2) Automating Response Once viewed as “risky” ... because we lacked certainty Automation needs to be “3 laws safe” Pre-defined responses Suspend account, Quarantine system, Reset virtual machine Delegate and simplify routine processes Make decision easier, more certain Enable swifter response Give time / freedom to prioritise activities All rights reserved © Tier-3 Pty Limited 2016
- 16. Benefits of Automated Response With increased certainty Diagnosis = Correct Risk of Delay > Risk of Action Automation means understanding • Nature of initial alert • Context of threat impact • Meaning of corroborating data • Impacts of proposed action All rights reserved © Tier-3 Pty Limited 2016
- 17. Automation long overdue Automation major part of solution to the friction problem: • Accurate data • Reliable context • Certainty on the situation Optimise handling of alert data from security “layers” • Avoid slowing down skilled resources with routine tasks Reduce friction and time at risk • Without having to increase effort All rights reserved © Tier-3 Pty Limited 2016
- 18. “Low Friction security” looks like ... Adding controls / detection capability continues to be necessary Landscape continues to evolve Operational load needs to be manageable Automating threat verification process Minimise false positives Understand real threats Provide greater certainty Automating response In a safe and acceptable way All rights reserved © Tier-3 Pty Limited 2016
- 19. We want HIGH FRICTION for attackers • Slow them down / Impede actions • Increase chance of detection / risk • Require more effort / time Increasing “Attacker Friction” means being PROACTIVE • Making attacks harder to mount successfully • This means freeing up time – our earlier point Examples include: • Tightening up controls and vulnerability management • Threat hunting to find possible or active/early stage attacks Note – Friction can be good... All rights reserved © Tier-3 Pty Limited 2016
- 20. Our Desired Outcome ATTACKER DEFENDER All rights reserved © Tier-3 Pty Limited 2016
- 21. Questions... Any Questions ? Please find me at the conference / get in contact if you want to explore this further Huntsman Security on Stand D160 All rights reserved © Tier-3 Pty Limited 2016
- 22. Thank you Piers Wilson piers.wilson@huntsmansecurity.com +44 (0) 7800 508517 +44 (0) 845 222 2010 www.huntsmansecurity.com @tier3huntsman
Notas do Editor
- Have observed from dealing with large enterprises customers, MSSP’s etc.
- Recognise the complexity – lots of controls, lot of interfaces, almost back to pre-siem days – EASIER SAID THAN DONE Need security to be effective Technology that supports Operations Interfaces and data models are a means to an end Coping with additional control layers / increasing detections Recognise security analysts and data scientists are scarce
- Having data and certainty reduces this risk Value of responding quickly, and in a repeatable way can outweigh downside i.e. risk of inaction > risk of action Data, context, threat data, business impacts and asset values drive this calculation Need data and analytic capability Give examples: Registry keys, network captures, file changes
- A robot may not injure a human being or, through inaction, allow a human being to come to harm. A robot must obey the orders given it by human beings except where such orders would conflict with the First Law. A robot must protect its own existence as long as such protection does not conflict with the First or Second Laws. Response in well defined circumstances or a portion of the response – like routine tasks Autopilot – can take back control – example of mature automation
- E.g. quarantining machine in secure VLAN, remove from guest wifi
- Volume Scalable processing Cope with additional control layers Scale across the expanding threat landscape Respond at speed Repeatable
- Not black and white – respond as much as is known to be safe with in the specific circumstances Certainty that it is safe, not based on feelings or hunches
- What level of automation would todays certainty give you – what would you automate / adopt today