Discusses how to improve security on the internets

1. A Framework and Prototype for
A Socio-Technical Security Information
and Event Management System
ST-SIEM
Bilal AlSabbagh
Department of Computer and Systems Science
Stockholm University
Stockholm, Sweden
bilal@dsv.su.se
Stewart Kowalski
Norwegian Information Security Lab
Center for Cyber and Information Security
Norwegian University of Science and Technology
Gjøvik, Norway
stewart.kowalski@ntnu.no

2. 2
Outline 19 slides 15 minutes!
• Personal Introductions
– Industrial Doctoral Student 1 slide
– A very old jaded Cyber Security (Knowledge) Worker (3 slides )
• Meta Goal and Goal $
– (5 minutes - 6 slides)
• Problem(s) and Background (s)
– (5 Minutes- 3 slides)
• Contributions
– (5 minutes – 4 slides)
• Questions and Next Steps
– 5 minutes 2-slides)

3. Bilal Al Sabbagh
• Academic Credentials:
– PhD Candidate, DSV, Stockholm University
– Research Interests:
• Social aspects of information security, security culture
– Academic Degrees
• MSc Information and Communication Systems Security, KTH, 2006
• BSc Computer Engineering, 2002
• Industrial Credentials
– Information and Network Security Consultant at
– Works full time with the security on the dot sa (Saudia Arabia),
– Industrial Credentials
• CISSP, CISA, CCSP, CCNA
3
10/2/2016
Bilal Al Sabbagh, - DSV

4. 4JAG= A CUP THAT RUNNETH OVER
My research work and industrial work in security stretch over 30
years and include both theoretical and empirical research in
security and product and services.

5. 5INDUSTRIAL VS UNIVERSITY
WORK
Deal with complex problems.
Must give simple solutions.
Deal with simple problems.
Must give complex solutions.
As a Professor “Swedish rumpnisse” in Norway I have earned the right to ask simple questions
and give complex answers!

6. 6
IT/IS SECURITY VALUE CHAIN
Researching
Teaching
Standardizing
+
Regulation
Product
Management
Development
Sales
Support
Operations
&
Services
Crypto Key Managment Systems Designer
Philips Fiancial Business System
1988

7. 7
Researching
Teaching
Standardizing
+
Regulation
Product
Management
Development
Sales
Support
Operations
&
Services
Crypto Key Managment Systems Designer
Philips Fiancial Business System
1988
Assitant Professor
Computer & Telecom
Secruity and Business
1989
Stockholm Universtiy
Royal Institute of Technology
University College Gävle
Stockholm School of Economics
IT/IS Security Value Chain

8. 8
Researching
Teaching
Standardizing
+
Regulation
Product
Management
Development
Sales
Support
Operations
&
Services
Manager
Research
Business + Security
Telia 1998
Crypto Key Managment Systems Designer
Philips Fiancial Business System
1988
Assitant Professor
Computer & Telecom
Secruity and Business
1989
Stockholm Universtiy
Royal Institute of Technology
University College Gävle
Stockholm School of Economics
IT/IS Security Value Chain

9. 9
Researching
Teaching
Standardizing
+
Regulation
Product
Management
Development
Sales
Support
Operations
&
Services
Manager
Research
Business + Security
Telia 1998
Senior Security
Management Consult Ericsson
1999
Crypto Key Managment Systems Designer
Philips Fiancial Business System
1988
Assitant Professor
Computer & Telecom
Secruity and Business
1989
Stockholm Universtiy
Royal Institute of Technology
University College Gävle
Stockholm School of Economics
IT/IS Security Value Chain

10. 10
Researching
Teaching
Standardizing
+
Regulation
Product
Management
Development
Sales
Support
Operations
&
Services
Manager
Research
Business + Security
Telia 1998
Senior Security
Management Consult Ericsson
1999
Strategic Product Manager
Security and Fraud Prevention
Core Networks Ericsson
2002
Crypto Key Managment Systems Designer
Philips Fiancial Business System
1988
Assitant Professor
Computer & Telecom
Secruity and Business
1989
Stockholm Universtiy
Royal Institute of Technology
University College Gävle
Stockholm School of Economics
IT/IS SECURITY VALUE CHAIN

11. 11
Researching
Teaching
Standardizing
+
Regulation
Product
Management
Development
Sales
Support
Operations
&
Services
Manager
Research
Business + Security
Telia 1998
Senior Security
Management Consult Ericsson
1999
Strategic Product Manager
Security and Fraud Prevention
Core Networks Ericsson
2002
Crypto Key Managment Systems Designer
Philips Fiancial Business System
1988
Manager
Ericsson Security
Evaluations
Competence Center
2003
Assitant Professor
Computer & Telecom
Secruity and Business
1989
Stockholm Universtiy
Royal Institute of Technology
University College Gävle
Stockholm School of Econmics
IT/IS SECURITY VALUE CHAIN

12. 12
Researching
Teaching
Standardizing
+
Regulation
Product
Management
Development
Sales
Support
Operations
&
Services
Manager
Research
Business + Security
Telia 1998
Senior Security
Management Consult Ericsson
1999
Strategic Product Manager
Security and Fraud Prevention
Core Networks Ericsson
2002
Crypto Key Managment Systems Designer
Philips Fiancial Business System
1988
Manger
Risk & Security
Business Unit Global Services
Global Network Operations Center
2006-2009
Manager
Ericsson Security Evaluations
Competence Center
2003
Assitant Professor
Computer & Telecom
Secruity and Business
1989
Stockholm Universtiy
Royal Institute of Technology
University College Gävle
Stockholm School of Economics
IT/IS SECURITY VALUE CHAIN

13. 13
Researching
Teaching
Standardizing
+
Regulation
Product
Management
Development
Sales
Support
Operations
&
Services
Manager
Research
Business + Security
Telia 1998
Senior Security
Management Consult Ericsson
1999
Strategic Product Manager
Security and Fraud Prevention
Core Networks Ericsson
2002
Crypto Key Managment Systems Designer
Philips Fiancial Business System
1988
Manger
Risk & Security
Business Unit Global Services
Global Network Operations Center
2006-2009
Manager
Ericsson Security Evaluations
Competence Center
2003
Associate Professor 17 May 2010
Assitant Professor
Computer & Telecom
Secruity and Business
1989
Stockholm Universtiy
Royal Institute of Technology
University College Gävle
Stockholm School of Economics
Senior Security Architecte and
Product Manager
Huawei Technologies
2009- 2011
IT/IS SECURITY VALUE CHAIN

14. 14
Researching
Teaching
Standardizing
+
Regulation
Product
Management
Development
Sales
Support
Operations
&
Services
Manager
Research
Business + Security
Telia 1998
Senior Security
Management Consult Ericsson
1999
Strategic Product Manager
Security and Fraud Prevention
Core Networks Ericsson
2002
Crypto Key Managment Systems Designer
Philips Fiancial Business System
1988
Manger
Risk & Security
Business Unit Global Services
Global Network Operations Center
2006-2009
Manager
Ericsson Security Evaluations
Competence Center
2003
Full time academic 1st April 2011
Associate Professor
Computer & Telecom
Secruity and Business
1989
Stockholm Universtiy
Royal Institute of Technology
University College Gävle
Stockholm School of Business
Senior Security Architecte and
Product Manager
Huawei Technologies
2009- 2011
IT/IS SECURITY VALUE CHAIN

15. Meta Goal of The Research
• 7 year industrial doctoral research plan to
investigate how best to add value $ to the socio-
technical global cyber security value chain.
In system X

16. Concrete Goal
Open Source Security Event Management Systems-
How to make it socio-technically efficient and
or/Cheaper?

17. A Value Chain is
• the interconnect group of industry participants that
collectively create value for the end user.
• If technologies or services are to succeed they must
deliver financial or operational value at every stage of the
chain.
• For any technology or service to be adopted, each
element on the chain must add value for the next
element.
Ref: The strategic Implications of Computing and the Internet on Wireless: The Competitive Blur Through 2008, Herschel Schoteck Associates. )
Meta-Goal

18. Security Spending Mental Models
IT Workers individuals (Saudi Arabia)
Personal
Organizational
Natiional
Spending
/Priority
Deter Prevent Detect Correct Recover
18Bilal Al Sabbagh, Stewart Kowalski - DSV

19. Comparing Swedish
and Norwegian
Bank’s
Security Value
Chain
Oct 2011

20. 20
Concrete Value Chain
Hardware Software Systems Services
“the primary defining concept in a value chain is what the customer
is willing to pay for”
Porter 1985 The Competitive Advantage

21. Security Value Chain
Concrete $ View
Hardware Software System ServicesBuyers
Total global market size for e-business security products in $ millions (2000–2005)
2000 2001 2002 2003 2004 2005
Access security 940 2,160 4,830 7,850 12,690 16,120
Communication
security
810 1,610 2,970 4,680 7,340 9,040
Content security 660 1,300 2,390 3,700 5,660 6,910
Security
Management
700 1,520 2,790 4,460 9,490 11,820
Services 410 1,020 2,390 4,610 9,050 14,780
Total 3,520 7,610 15,370 25,300 44,230 58,670
$ Security Incident Event
Management Systems and Services $

22. Outline
• Goal and Meta Goal $
– (5 minutes - 6 slides)
• Concrete Problem and Background
– (5 Minutes- 3 slides)
• Contributions
– (5 minutes – 4 slides)
• Questions and Next Steps
– 5 minutes 2-slides)

23. National Computer Emergency Response Teams (CERT)s Role
• Support organizations with security incident
response capabilities
• Provide actionable security information
• Utilize several tools (SIEMs and others) for
effectiveness and efficiency
• Collects; prepare; process; enrich ;
disseminate security information
Background

24. Problems with Security Event Management
Reduce False positives by ABC = Always be contextualizing
Ref : https://www.linkedin.com/pulse/contextualization-security-analytics-niranjan-mayya
Hardware Software System ServicesBuyers
$ Security Incident Event
Management Systems and Services $

25. ENISA HIGHLIGHTS
• Actionable information disseminated by CERTs are not equally
relevant (or even actionable) to constituents
• Challenges for security managers how to respond to this
information using their information security management
systems (ISMS)
Problem
CERT.SE
Company X SIEM
Company X ISMS

26. Outline
• Goal and Meta Goal $
– (5 minutes - 2 slides)
• Problem and Background
– (5 Minutes- 5 slides)
• Contributions
– (5 minutes – 6 slides)
• Questions and Next Steps
– 5 minutes 2-slides

27. Paper contribution
1. Framework for a socio-technical SIEM to
improve security response at organizations
2. Correlating technical security events with the
risk escalation maturity levels of constituents
(socio-technical)
3. The risk factor is not generic but directed
based on the organization security culture
and technological security posture

28. Paper contribution 1
• Framework for a socio-technical SIEM to
improve security response at organizations

29. Paper contribution
1. Framework for a socio-technical SIEM to
improve security response at organizations
2. Correlating technical security events with the
risk escalation maturity levels of constituents
(socio-technical)
3. The risk factor is not generic but directed
based on the organization security culture
and technological security posture

30. Framework for information security risk
management and escalation
Combination of NIST and ISO Frameworks

31. Risk escalation maturity levels
Non-
existent
Repeatable
Defined
Managed
Optimized
Risk
Escalation
Maturity
Awareness
Responsibility
Reporting
Policies/Standards
Knowledge/education
Procedures/tools

32. Paper contribution
1. Framework for a socio-technical SIEM to
improve security response at organizations
2. Correlating technical security events with the
risk escalation maturity levels of constituents
(socio-technical)
3. The risk factor is not generic but directed
based on the organization security culture
and technological security posture

33. Security Event: Managed organization firewall has rejected a
connection from a source host to the destination organization asset
because the configured per-client connections limit was exceeded.
Priority: 1 of 5 Reliability: 1 of 10
Targeted asset value: 4 of 5 (Asset in this case was the DNS
server)
Risk factor: 4 x 1 x 1 /25 = 0.16 of 10
Contribution 3
Page 73 of the user guide https://www.alienvault.com/doc-repo/usm/v5/USM-v5-User-Guide.pdf

34. 34
Outline
• Goal and Meta Goal $
– (5 minutes - 2 slides)
• Problem and Background
– (5 Minutes- 5 slides)
• Contributions
– (5 minutes – 4 slides)
• Next Steps and Your Suggestion Questions
– 5 minutes 2-slides

35. Next Step
Desk-Top/Ex-Post Risk Scenario
Test of Socio-technical Correlation Engine
Risk factor = f (security event technical attributes, organization risk escalation maturity level)
?
EX-post
Ex-Ante
Risk
Scenari
o
?
CERT.X
Org ML3
Org ML3..MLN

36. A global Socio-Technical cyber security Warning
Systems
36
>?<