Take the Red Pill: Becoming One with Your Computing Environment using Security Intelligence

(1)

Take the Red Pill: Becoming One

with Your Computing Environment

using Security Intelligence

Chris Poulin

Security Strategist, IBM

(2)

Securing Information Resources is a Multi-Dimensional Puzzle

People

Data

Applications

Infrastructure

Hackers

Outsourcers

Suppliers

Systems

applications

Web

Applications

Web 2.0

Mobile apps

Structured

Unstructured

At rest

_{In motion}

It is no longer possible to define and protect the perimeter, but demands a focus on

protecting data. Point products are not sufficient to protect the enterprise.

Consultants

Terrorists

_Customers

(3)

Getting Intimate with Your Computing Environment

How well do you know:



Applications? Owners? Activity patterns?



Where sensitive data resides?

(4)

Why Take the Red Pill?

(5)

How to Get There: Security Intelligence

Extensive Data

Sources

Deep

Intelligence

Exceptionally Accurate and

Actionable Insight

+

=

Suspected Incidents

Event Correlation

Activity Baselining & Anomaly

Detection

• Logs

• Flows

• IP Reputation

• Geo Location

• User Activity

• Database Activity

• Application Activity

• Network Activity

Offense Identification

• Credibility

• Severity

• Relevance

Database Activity

Servers & Hosts

Vulnerability Info

Configuration Info

Security Devices

Network & Virtual Activity

(6)

What is Security Intelligence?

Security Intelligence

--noun

1. the real-time collection, normalization, and analytics of the

data generated by users, applications and infrastructure that

impacts the IT security and risk posture of an enterprise

Security Intelligence provides actionable and comprehensive

insight for managing risks and threats from protection and

detection through remediation

(7)

Activity and Data Access Monitoring

Visualize Data Risks

Automated charting and reporting

on potential attacks

Correlate System, Application,

& Network Activity

Enrich security alerts with anomaly

detection and flow analysis

Detect suspicious activity before it leads to a breach

(8)

(9)

(10)

(11)

Alert on data patterns, such as credit card

number, in real time.

Who is responsible for the data leak?

(12)

(13)

(14)

(15)

Customize Your Network Landscape for Contextual Visibility

(16)

(17)

(18)

User Activity Monitoring to Combat Advanced Persistent Threats

User & Application

Activity Monitoring alerts

on a user anomaly for

Oracle database access.

(19)

Baselining Complex Patterns

 Complex patterns can be baselined

(20)

Configuration & Risk

Network topology and open

paths of attack add context

Rules can take exposure

into account to:

• Prioritize offenses and

remediation

• Enforce policies

(21)

Security Intelligence Timeline

Prediction & Prevention

Risk Management. Vulnerability Management. Configuration Monitoring. Patch Management. X-Force Research and Threat Intelligence. Compliance Management. Reporting and Scorecards.

Reaction & Remediation

SIEM. Log Management. Incident Response.

(22)

Security Intelligence Wrap-Up

 Monitor all activity and correlate in real time

 Reduce cost & complexity, lower TCO, compliance

 Detect policy violations

 Baseline against reality (CMDB)

 Social media, P2P, etc.

 Detect suspicious behavior

 Privileged actions from a contractor’s workstation

 DNS communications with external system

 Detect APTs

 File accesses out of the norm—behavior anomaly detection

 Least used applications or external systems; occasional traffic

 Detect fraud

 Baseline credit pulls or trading volumes, and detect anomalies

 Correlate eBanking PIN change with large money transfers

 Forensic evidence for prosecution

(23)

IBM’s Security Intelligence, Analytics and Big Data portfolio

1 IBM QRadar

_{Security Intelligence}

unified architecture for collecting, storing, analyzing and querying log, threat, vulnerability and risk related data

2 IBM Big Data Platform (Streams, Big Insights, Netezza)

_{addresses the speed and flexibility required for customized data}

exploration, discovery and unstructured analysis

3 IBM i2

_{Analyst Notebook}

helps analysts investigate fraud by discovering patterns and trends across volumes of data

4 IBM SPSS

_{unified product family to}

(24)

Thank You!

(25)

ibm.com/security

provided AS IS without warranty of any kind, express or implied. IBM shall not be responsible for any damages arising out of the use of, or otherwise related to, these materials. Nothing contained in these materials is intended to, nor shall have the effect of, creating any warranties or representations from IBM or its suppliers or licensors, or altering the terms and conditions of the applicable license agreement governing the use of IBM software. References in these materials to IBM products, programs, or services do not imply that they will be available in all countries in which IBM operates. Product release dates and/or capabilities referenced in these materials may change at any time at IBM’s sole discretion based on market opportunities or other factors, and are not intended to be a commitment to future product or feature availability in any way. IBM, the IBM logo, and other IBM products and services are trademarks of the International Business Machines Corporation, in the United States, other countries or both. Other company, product, or service names may be trademarks or service marks of others.