Security Analytics
for Smart Grid
Dr. Robert W. Griffin
Chief Security Architect
RSA, the Security Division of EMC
[email protected]
No Shortage of Hard Security Challenges
Infrastructure
Transformation
Mobile
Cloud
Less control over access
device and back-end
infrastructure
Threat Landscape
Transformation
APTs
Sophisticated
Fraud
Fundamentally
different tactics, more
Emergence of New Attackers
Nation
state
actors
PII, government, defense industrial base, IP
rich organizations
Criminals
Petty criminals
Organized crime
Organized, sophisticated supply
chains (PII, financial services,
retail)
Unsophisticated
Non-state
actors
Terrorists
Anti-establishment vigilantes
“Hacktivists”
Targets of opportunity
PII, Government,
Speed
Response Time
2
Decrease
Dwell Time
1
TIME
Attack Identified
Response
System
Intrusion
Begins
Attack
Cover-Up
Complete
Targeted Attacks
Cover-Up Discovery
Leap Frog Attacks
1
TARGETED
SPECIFIC OBJECTIVE
STEALTHY
LOW AND SLOW
2
3
INTERACTIVE
HUMAN INVOLVEMENT
Incident
Response
Endpoint
Visibility
& Analysis
Additional
Business &
IT Context
Threat Intelligence | Rules | Parsers | Alerts | Feeds | Apps | Directory Services | Reports & Custom Actions
Capture Time
Data
Enrichment
PACKET METADATADistributed
Data
Collection
PACKETSLIVE
LIVE
LIVE
PARSING & METADATA TAGGING LOGS LOG METADATAReporting
& Alerting
Investigation
& Forensics
Compliance
Malware
Analysis
Intelligence
Feeds
Network Security Use Case
(capture)
Incident
Response
Endpoint
Visibility
& Analysis
Additional
Business &
IT Context
Threat Intelligence | Rules | Parsers | Alerts | Feeds | Apps | Directory Services | Reports & Custom Actions
Incident Detection Use Case
(streaming)
Incident
Response
Endpoint
Visibility
& Analysis
Additional
Business &
IT Context
Threat Intelligence | Rules | Parsers | Alerts | Feeds | Apps | Directory Services | Reports & Custom Actions
Capture Time
Data
Enrichment
Distributed
Data
Collection
LIVE
LIVE
LIVE
PARSING & METADATA TAGGINGLOGS METADATA LOG
Advanced Analysis Use Case
(historical)
Incident
Response
Endpoint
Visibility
& Analysis
Additional
Business &
IT Context
Threat Intelligence | Rules | Parsers | Alerts | Feeds | Apps | Directory Services | Reports & Custom Actions
Incident
Response
Endpoint
Visibility
& Analysis
Additional
Business &
IT Context
Threat Intelligence | Rules | Parsers | Alerts | Feeds | Apps | Directory Services | Reports & Custom Actions
Capture Time
Data
Enrichment
PACKET METADATADistributed
Data
Collection
PACKETSLIVE
LIVE
LIVE
PARSING & METADATA TAGGING LOGS LOG METADATAReporting
& Alerting
Investigation
& Forensics
Compliance
Malware
Analysis
Intelligence
Feeds
Anomalous Behavior Detection
Differentiating Cyber Criminals from Online Customers
Sign-in
Homepage
My Account
Bill Pay Home
Add Bill Payee
Enter Pay Amount
Select Bill Payee
Compromised Host Investigation
Find compromised Server
or Workstation acting as SPAM host
Multiple outbound SMTP connections from workstation.
Multiple internet DNS connections from workstation
Find out how the
workstation got infected
User clicked on the link and got infected by
Trojan from drive-by download.
Recreate phishing
e-mail message
Determine whether targeted
phishing attack at play
Analyze malware
Determine whether targeted
or vanilla malware in use
2
3
4
Single UI
Incident Management & Reporting
Visibility
Security
Architecture
Team
Device Administration Data Warehouse & Ticketing SystemIT Team
Applying Security Analytics
Readiness, Response & Resilience (R3)
Workflow & Automation, Rules, Alerts & Reports
Threat Triage
