Security crawl walk run presentation mckay v1 2017
•Als PPTX, PDF herunterladen•
3 gefällt mir•1,061 views
How to go from crawl to walk to run with Splunk for Security. By Dimitri McKay, Staff Security Architect, Splunk
Empfohlen
Empfohlen
Weitere ähnliche Inhalte
Was ist angesagt?
Was ist angesagt? (20)
Ähnlich wie Security crawl walk run presentation mckay v1 2017
Ähnlich wie Security crawl walk run presentation mckay v1 2017 (20)
Kürzlich hochgeladen
Kürzlich hochgeladen (20)
Security crawl walk run presentation mckay v1 2017
- 1. © 2017 SPLUNK INC.© 2017 SPLUNK INC. crawl|walk|run Splunk for Security Dimitri McKay | Staff Security Architect | Splunk
- 2. © 2017 SPLUNK INC. During the course of this presentation, we may make forward-looking statements regarding future events or the expected performance of the company. We caution you that such statements reflect our current expectations and estimates based on factors currently known to us and that actual events or results could differ materially. For important factors that may cause actual results to differ from those contained in our forward-looking statements, please review our filings with the SEC. The forward-looking statements made in this presentation are being made as of the time and date of its live presentation. If reviewed after its live presentation, this presentation may not contain current or accurate information. We do not assume any obligation to update any forward-looking statements we may make. In addition, any information about our roadmap outlines our general product direction and is subject to change at any time without notice. It is for informational purposes only and shall not be incorporated into any contract or other commitment. Splunk undertakes no obligation either to develop the features or functionality described or to include any such feature or functionality in a future release. Splunk, Splunk>, Listen to Your Data, The Engine for Machine Data, Splunk Cloud, Splunk Light and SPL are trademarks and registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners. © 2017 Splunk Inc. All rights reserved. Forward-Looking Statements
- 3. © 2017 SPLUNK INC. Agenda Splunk Level Set Intro Maturity Crawl Walk Run Summary
- 4. © 2017 SPLUNK INC. Intro Maturity
- 5. Technology PeopleProcess 3 equal parts make a mature security program
- 6. © 2017 SPLUNK INC. Maturity of a Security Program Search and Investigate Proactive Monitoring and Alerting Security Situational Awareness Real-time Risk Insight Proactive Reactive - Reactive security - Limited visibility - Limited data-sources - Data spread across multiple silos - Specific data-sources captured - Realtime monitoring for specific basic use cases - Simple correlation alerts in use - Monitoring in real-time. - High fidelity correlation in use. - Basic automation for enrichment. - Threat data plays a heavy role in security processes. - Risk framework used to prioritize activity. - Automation is used to reduce noise and threat. - Breaches identified in real-time and thwarted before exfil.
- 7. © 2017 SPLUNK INC. https://github.com/swannman/ircapabilities https://creativecommons.org/licenses/by/4.0/
- 8. © 2017 SPLUNK INC. Crawl How do I get started?
- 9. © 2017 SPLUNK INC. https://github.com/swannman/ircapabilities https://creativecommons.org/licenses/by/4.0/
- 10. © 2017 SPLUNK INC. 200+ APPS The Splunk Platform for Security Intelligence Splunk Enterprise (CORE) Stream data Cisco Security Suite Windows/ AD/ Exchange Palo Alto Networks FireEye Bit9 DShield DNS OSSEC Splunk-built AppsSplunk for Security
- 11. © 2017 SPLUNK INC. Step one? Download Splunk. :)
- 12. © 2017 SPLUNK INC. But, consider starting with these top 5 data sources…
- 13. © 2017 SPLUNK INC. #1 Windows Splunk Add-on for Microsoft Windows
- 14. © 2017 SPLUNK INC. ► Authentication: - Success/ Failures - New account logons - Unused accounts - Anomalous logins ► Endpoint changes: - New applications/ processes - New ports - New services Windows Use Cases #1 Windows Splunk Add-on for Microsoft Windows
- 15. © 2017 SPLUNK INC. #2 Linux Splunk Add-on for Unix and Linux Add-on for Auditd
- 16. © 2017 SPLUNK INC. #2 Linux Splunk Add-on for Unix and Linux Add-on for Auditd ► Authentication: - Success/ Failures - New account logons - Unused accounts - Anomalous logins ► Endpoint changes: - New applications/ processes - New ports - New services Linux Use Cases
- 17. © 2017 SPLUNK INC. #3 Firewalls Splunk Add-on for Juniper, Cisco, Palo Alto, etc.
- 18. © 2017 SPLUNK INC. #3 Firewalls Splunk Add-on for Juniper, Cisco, Palo Alto, etc. ► Top categories ► Top apps consuming bandwidth ► Top protocol use ► Top bandwidth consumers ► Top threats by user/host/src ► Top blocked executables ► Top vulnerabilities / vulnerable machines ► Top targets ► Top actions ► Top malware Firewall Use Cases
- 19. © 2017 SPLUNK INC. #4 AWS + Cloud Services Adoption of Cloud in the Security space
- 20. © 2017 SPLUNK INC. #4 AWS + Cloud Services Adoption of Cloud in the Security space ► Network ACLs ► Security groups ► IAM activity ► S3 data events ► VPC activity/traffic/security analysis ► Cloudfront/ELB/S3 Traffic Analysis ► Top user activity ► Top resource activity AWS/Cloud Use Cases
- 21. © 2017 SPLUNK INC. #5 Anti-virus Symantec and McAfee antivirus suites
- 22. © 2017 SPLUNK INC. #5 Anti-virus Symantec and McAfee antivirus suites ► Top risks detected ► Top processes blocked ► Top viruses / spyware detected ► Malware client version reports ► Malware virus definitions version reports ► Host changes / modifications Anti-virus Use Cases
- 23. © 2017 SPLUNK INC. With these top 5 data sources you manage… ► Detection of Possible Brute Force Attacks ► Detection of Insider Threat ► Expected Host/Log Source Not Reporting ► Unusual Login Behavior ► Unexpected Events Per Second (EPS) from Log Sources ► Detection of Anomalous Ports, Services and Unpatched Devices ► More… http://resources.infosecinstitute.com/top-6-seim-use-cases/#gref
- 24. © 2017 SPLUNK INC. Use Cases + Apps Dive into more advanced use cases
- 25. © 2017 SPLUNK INC. Next, Dive Into More Advanced Use Cases Security Intelligence Use Cases Security & Compliance Reporting Real-time Monitoring of Known Threats Root Cause Analysis Action AlertingIncident Investigations & Forensics
- 26. © 2017 SPLUNK INC. Splunk Security Essentials Access and Network Domain Access Domain • Authentication Against a New Domain Controller • First Time Logon to New Server • Significant Increase in Interactively Logged On Users • Geographically Improbable Access (Superman) • Increase in # of Hosts Logged into • New AD Domain Detected • New Interactive Logon from a Service Account • New Local Admin Account • New Logon Type for User • Short Lived Admin Accounts • Significant Increase in Interactive Logons Network Domain • Detect Algorithmically Generated Domains • Remote PowerShell Launches • Source IPs Communicating with Far More Hosts Than Normal • Sources Sending Many DNS Requests • Sources Sending a High Volume of DNS Traffic
- 27. © 2017 SPLUNK INC. Splunk Security Essentials for Ransomware The following are the Use Cases included in this app 1. Fake Windows Processes 2. Malicious Command Line Executions 3. Monitor AutoRun Reported Registry Keys 4. Monitoring Successful Backups 5. Monitor Successful Windows Update 6. Monitoring Unsuccessful Backups 7. Monitor Successful Windows Update 8. Ransomware extensions 9. Ransomware Note Files 10. Ransomware Vulnerabilities 11. SMB traffic Allowed 12. Spike in SMB traffic 13. Detect TOR Traffic
- 28. © 2017 SPLUNK INC. CIS Critical Security Controls The CIS Critical Security Controls app for Splunk was designed to provide a consolidated, easily-extensible framework for baseline security “best- practices” based on the Top 20 Critical Security Controls published by the Center for Internet Security. Framework for Baseline Security
- 29. © 2017 SPLUNK INC. Crawl How do I get started?
- 30. © 2017 SPLUNK INC. https://github.com/swannman/ircapabilities https://creativecommons.org/licenses/by/4.0/
- 31. © 2017 SPLUNK INC. https://github.com/swannman/ircapabilities https://creativecommons.org/licenses/by/4.0/
- 32. © 2017 SPLUNK INC. Splunk Enterprise Security Analytics SIEM Monitoring | Reporting | Alerting • 50,000 foot view of of the organization’s security posture • Out of the box dashboards, reports, correlated alerts, and incident response workflows • Significant Increase in Interactively Logged On Users • Detect unusual activities by leveraging statistical analysis, dynamic thresholds, and anomaly detection. • Verify privileged access and detect unusual activity by applying user- and asset-based context to all Cloud, on-premises and hybrid machine data to monitor user and asset activities. Threat | Case Management • Leverage threat feeds from a broad set of sources, including free threat intelligence feeds, third party subscriptions, law enforcement, FS- ISAC , STIX/TAXII, the Department of Homeland Security’s (DHS) Automated Indicator Sharing (AIS), Facebook ThreatExchange, internal and shared dataRemote PowerShell Launches • Manage alerts/cases and investigations in one place, with the ability to pivot between data sources to decrease remediate and investigation time, thereby reducing risk.
- 33. © 2017 SPLUNK INC. Crawl How do I get started?
- 34. © 2017 SPLUNK INC. https://github.com/swannman/ircapabilities https://creativecommons.org/licenses/by/4.0/
- 35. © 2017 SPLUNK INC. https://github.com/swannman/ircapabilities https://creativecommons.org/licenses/by/4.0/ https://github.com/swannman/ircapabilities https://creativecommons.org/licenses/by/4.0/
- 36. © 2017 SPLUNK INC. Splunk UBA + Enterprise Security Unsupervised Machine Learning Business Risk | Machine Learning • Detects insider threats using out-of-the-box purpose-built but extensible unsupervised machine learning (ML) algorithms • Provides context around the threat via ML driven anomaly correlation and visual mapping of stitched anomalies over various phases of the attack lifecycle (Kill Chain View) • Increases SOC efficiency with rank-ordered threats and supporting evidence • Prioritize assets and identities based on criticality to the business, which then prioritizes alerts and case management as the most important events bubble to the surface. High Fidelity Alerting + Orchestration • By integrating UBA with Enterprise Security, high fidelity alerts are then fed into a central location for remediation. • Alerts are also then actionable, allowing Splunk to orchestrate and automate a response via a single common interface for retrieval, sharing, and response in multi-vendor environments. Examples of those responses might be segregating a host off of a network, re-setting a users password, pushing out antivirus definitions to machines with out of date updates, or blocking IPs and URLs found in threat lists.
- 37. © 2017 SPLUNK INC. Summary In Conclusion
- 39. The Platform PLATFORM SOLUTIONS Analytics,Awareness&Action Vendor Apps | Community Apps | Use Case Apps | Showcase Apps
- 40. The Platform Incident Investigations and Forensics Security and Compliance Real-Time Monitoring Root Cause Analysis Automation And Orchestration Reporting And Alerting PLATFORM USE CASES SOLUTIONS Analytics,Awareness&Action Vendor Apps | Community Apps | Use Case Apps | Showcase Apps
- 41. © 2017 SPLUNK INC. End Thank you!
Hinweis der Redaktion
- In the world of security, it’s an on-going process of adding and replacing tools, up-leveling our people and up-leveling our processes. The above slide illustrates the various levels to achieve that will aid in maturing your corporate security program. But start with the basics.
- In this presentation, we’ll talk about how to get started with Splunk for security. We’ll start with the platform. We’ll discuss the top data sources and the top use cases to get you started. And we’ll talk about where to go from there in your Splunk journey.
- But you’re probably wondering, how do I get started? Excellent question.
- Most programs start here. It’s a purely reactive program. When an event takes place, there’s a scurry of activity, but it’s all knee jerk reactions. The challenge here is that there is very little visibility because they haven’t centralized their data, so they have to jump around, wasting time, searching silo to silo trying to piece together answers to their questions. Investigations, in these programs, are a massive time suck. Stage two, instead of waiting for awful news to arrive, the team begins monitoring the network to be more proactive. There is still a limited centralization of data, and realtime monitoring is done only for specific use cases and specific source-types, but the goal here is to increase maturity striving for a more proactive stance. And this is where customers begin to see the value of Splunk. Basic alerting and monitoring is configured for the highest priority items, however, in many cases, the focus is on IT risk, not business risk. Stage three is where things get interesting. This is where Security teams have become situationally aware. At this point, as part of that security journey, these teams have centralized all of their data into Splunk, they are monitoring threats in real-time, they are using correlation in their alerts to reduce noise, they’ve focused on automation as a way of enriching data and they’ve begun to use threat data from various commercial sources, community feeds or government agencies. But here, stage four, at the top of the maturity stack, is when organizations are in full proactive mode. Here, they’re focusing their time and effort into the most important assets and identities based on their risk score. They’ve used automation to greatly reduce the number of alerts that trigger per day, instead, opting for an orchestration strategy that either blocks users from getting to known bad sites, to automatically segregating a endpoints to a segregated VLAN when suspicious activity is detected, and/or the user passwords are automatically reset upon suspicious behavior being detected. At this point, the security program can focus on the most important items, and can thwart breaches in real-time to avoid the exifil altogether.
- But you’re probably wondering, how do I get started? Excellent question.
- But you’re probably wondering, how do I get started? Excellent question.
- But you’re probably wondering, how do I get started? Excellent question.
- We’ll start with the top 5 most popular data sources. Each of the following sources has a TA, which is essentially a parser, that will extract all of the fields such as Source IP, Hostname, User, etc. and prep the data for the apps that we will also install, apps that offer reports, alerts and searches, out of the box.
- Windows is number one. We can ingest data from Windows a number of ways from sysmon, to WMI to 3rd party forwarders like Snare. But the best way is to use a Splunk Universal Forwarder. It’s a very light weight collector, compresses and forwards the data, and is very flexible in the data it can collect from each source. Universal Forwarder: https://www.splunk.com/en_us/download/universal-forwarder.html Windows TA https://splunkbase.splunk.com/app/742/ Active Directory TA https://splunkbase.splunk.com/app/3207/ Windows App for Infrastructure https://splunkbase.splunk.com/app/1680/
- Windows is number one. We can ingest data from Windows a number of ways from sysmon, to WMI to 3rd party forwarders like Snare. But the best way is to use a Splunk Universal Forwarder. It’s a very light weight collector, compresses and forwards the data, and is very flexible in the data it can collect from each source. Universal Forwarder: https://www.splunk.com/en_us/download/universal-forwarder.html Windows TA https://splunkbase.splunk.com/app/742/ Active Directory TA https://splunkbase.splunk.com/app/3207/ Windows App for Infrastructure https://splunkbase.splunk.com/app/1680/
- And once that data is ingested, here are some examples of use cases you can satisfy using the Splunk App for Windows Infrastructure. Universal Forwarder: https://www.splunk.com/en_us/download/universal-forwarder.html Windows TA https://splunkbase.splunk.com/app/742/ Active Directory TA https://splunkbase.splunk.com/app/3207/ Windows App for Infrastructure https://splunkbase.splunk.com/app/1680/
- Next up? Linux. Linux can be ingested as syslog, or, even better, you can use a Splunk Universal Forwarder here also. It’ll capture the local data, then send it off to your Splunk instance, index it, and make it available for the unix app. Universal Forwarder https://www.splunk.com/en_us/download/universal-forwarder.html Add-on for Unix/Linux https://splunkbase.splunk.com/app/833/ Splunk app for Unix/Linux https://splunkbase.splunk.com/app/273/
- Next up? Linux. Linux can be ingested as syslog, or, even better, you can use a Splunk Universal Forwarder here also. It’ll capture the local data, then send it off to your Splunk instance, index it, and make it available for the unix app. Universal Forwarder https://www.splunk.com/en_us/download/universal-forwarder.html Add-on for Unix/Linux https://splunkbase.splunk.com/app/833/ Splunk app for Unix/Linux https://splunkbase.splunk.com/app/273/
- And here are a number of use cases that the Linux TA and the *NIX app can offer. Universal Forwarder https://www.splunk.com/en_us/download/universal-forwarder.html Add-on for Unix/Linux https://splunkbase.splunk.com/app/833/ Splunk app for Unix/Linux https://splunkbase.splunk.com/app/273/
- The two most popular firewalls that our customers use are Palo Alto firewalls and Cisco. Palo Alto and Cisco created their own apps and TAs for Splunk which highlight all of their specific features and capabilities. Palo Alto: TA for Palo Alto https://splunkbase.splunk.com/app/2757/ Splunk app for Palo Alto https://splunkbase.splunk.com/app/491/ Cisco: (docs for the following) https://splunkbase.splunk.com/app/525/#/details Cisco Security Suite https://splunkbase.splunk.com/app/525/ TA for Cisco ASA https://splunkbase.splunk.com/app/1620/ TA for Cisco WSA https://splunkbase.splunk.com/app/1747/ TA for Cisco ESA https://splunkbase.splunk.com/app/1761/ TA for Cisco ISE https://splunkbase.splunk.com/app/3064/ TA for Cisco FireSight https://splunkbase.splunk.com/app/1808/
- The two most popular firewalls that our customers use are Palo Alto firewalls and Cisco. Palo Alto and Cisco created their own apps and TAs for Splunk which highlight all of their specific features and capabilities. Palo Alto: TA for Palo Alto https://splunkbase.splunk.com/app/2757/ Splunk app for Palo Alto https://splunkbase.splunk.com/app/491/ Cisco: (docs for the following) https://splunkbase.splunk.com/app/525/#/details Cisco Security Suite https://splunkbase.splunk.com/app/525/ TA for Cisco ASA https://splunkbase.splunk.com/app/1620/ TA for Cisco WSA https://splunkbase.splunk.com/app/1747/ TA for Cisco ESA https://splunkbase.splunk.com/app/1761/ TA for Cisco ISE https://splunkbase.splunk.com/app/3064/ TA for Cisco FireSight https://splunkbase.splunk.com/app/1808/
- And here are some examples of various use cases that can be satiated by that firewall data (or the next gen firewall data, such as Palo Altos) out of the box, using the vendor apps.
- We’re seeing more and more adoption of Cloud in the security space. AWS is our fourth most popular data-source. The AWS apps are used to monitor AWS instances for compliance, for security, and even for billing and performance. AWS TA: https://splunkbase.splunk.com/app/1876/ Splunk App for AWS: https://splunkbase.splunk.com/app/1274/ App for AWS Billing: https://splunkbase.splunk.com/app/1577/ AWS Compliance and Security Analyzer: https://splunkbase.splunk.com/app/3395/
- We’re seeing more and more adoption of Cloud in the security space. AWS is our fourth most popular data-source. The AWS apps are used to monitor AWS instances for compliance, for security, and even for billing and performance. AWS TA: https://splunkbase.splunk.com/app/1876/ Splunk App for AWS: https://splunkbase.splunk.com/app/1274/ App for AWS Billing: https://splunkbase.splunk.com/app/1577/ AWS Compliance and Security Analyzer: https://splunkbase.splunk.com/app/3395/
- Here’s some examples of use cases satiated out of the box with the AWS apps. AWS TA: https://splunkbase.splunk.com/app/1876/ Splunk App for AWS: https://splunkbase.splunk.com/app/1274/ App for AWS Billing: https://splunkbase.splunk.com/app/1577/ AWS Compliance and Security Analyzer: https://splunkbase.splunk.com/app/3395/
- Lastly, Anti-virus. The top two Antivirus suites used by our customers is Symantec and McAfee. We have TAs for both. Symantec: Splunk App for Symantec: https://splunkbase.splunk.com/app/1365/ Symantec Endpoint Protection TA https://splunkbase.splunk.com/app/2772/ Symantec Endpoint Protection TA for Syslog: https://splunkbase.splunk.com/app/3121/ McAfee: McAfee TA https://splunkbase.splunk.com/app/1819/
- And here are the use cases that you can satisfy by capturing your antivirus data. Symantec: Splunk App for Symantec: https://splunkbase.splunk.com/app/1365/ Symantec Endpoint Protection TA https://splunkbase.splunk.com/app/2772/ Symantec Endpoint Protection TA for Syslog: https://splunkbase.splunk.com/app/3121/ McAfee: McAfee TA https://splunkbase.splunk.com/app/1819/
- Lastly, Anti-virus. The top two Antivirus suites used by our customers is Symantec and McAfee. We have TAs for both. Symantec: Splunk App for Symantec: https://splunkbase.splunk.com/app/1365/ Symantec Endpoint Protection TA https://splunkbase.splunk.com/app/2772/ Symantec Endpoint Protection TA for Syslog: https://splunkbase.splunk.com/app/3121/ McAfee: McAfee TA https://splunkbase.splunk.com/app/1819/
- So, with those five data sources, you’re able to knock out the top 6 SIEM use cases according to the Infosec Institute.
- But you’re not limited to specific data-source apps. There are a number of additional apps that can up-level your security program by leveraging industry controls, and recommendations from companies such as SANS and MITRE. CIS20 | Critical Controls: https://splunkbase.splunk.com/app/3064/ Splunk Security Essentials: https://splunkbase.splunk.com/app/3435/ Splunk Security Essentials for Ransomware: https://splunkbase.splunk.com/app/3593/
- The CIS Controls app for Splunk was designed to provide a consolidated, easily-extensible framework for baseline security “best-practices” based on the Top 20 Critical Security Controls v6.1 published by the Center for Internet Security.
- But you’re probably wondering, how do I get started? Excellent question.
- In the world of security, it’s an on-going process of adding and replacing tools, up-leveling our people and up-leveling our processes. The above slide illustrates the various levels to achieve that will aid in maturing your corporate security program. But start with the basics. https://github.com/swannman/ircapabilities https://creativecommons.org/licenses/by/4.0/
- But you’re probably wondering, how do I get started? Excellent question.
- In summary, we introduced you to Splunk for Security, introduced you to the top five data-sources and the associated use cases that will get you started in your Splunk Security Journey. Lastly, we talked about how to mature that security program over-time to protect your corporate network.
- In summary, we introduced you to Splunk for Security, introduced you to the top five data-sources and the associated use cases that will get you started in your Splunk Security Journey. Lastly, we talked about how to mature that security program over-time to protect your corporate network.