A New Approach to Threat Detection: Big Data Security Analytics
•Als PPTX, PDF herunterladen•
0 gefällt mir•338 views
Learn how to distill billions of events into a handful of security leads. Security analytics powered by machine learning is proven to make your SOC more efficient. This presentation includes four case studies.
Empfohlen
Empfohlen
Weitere ähnliche Inhalte
Was ist angesagt?
Was ist angesagt? (17)
Ähnlich wie A New Approach to Threat Detection: Big Data Security Analytics
Ähnlich wie A New Approach to Threat Detection: Big Data Security Analytics (20)
Kürzlich hochgeladen
Kürzlich hochgeladen (20)
A New Approach to Threat Detection: Big Data Security Analytics
- 1. 1 | © 2017 Interset Software A New Approach to Threat Detection: Big Data Security Analytics Paul Reid, Technology Strategist October 2017
- 2. 2 | © 2017 Interset Software Alert Fatigue = Playing ”Where is Waldo”
- 3. 3 | © 2017 Interset Software Not Enough Time, Not Enough People
- 4. 4 | © 2017 Interset Software Standard Approach – Rules and Thresholds A Pattern for Increased Monitoring for Intellectual Property Theft by Departing Insiders, Andrew Moore, Carnegie Mellon 2011
- 5. 5 | © 2017 Interset Software The Threshold Approach Challenge Abnormal Normal
- 6. 6 | © 2017 Interset Software The Threshold Approach Challenge Abnormal Normal
- 7. 7 | © 2017 Interset Software The Threshold Approach Challenge Abnormal Normal
- 8. 8 | © 2017 Interset Software A Probabilistic Approach • Computes probability that a value in a given hour is anomalous • Bayesian approach • Explicitly models both normal and abnormal distributions • Gaussian, Gamma • Estimators for both normal and abnormal based on observation
- 9. 9 | © 2017 Interset Software New Approach: Distill Billions of Events into Security Leads A Handful of Threat LeadsBillions of Events Hundreds of Anomalies
- 10. 10 | © 2017 Interset Software Anomaly Detection and Risk Scoring Process Data Acquisition Correlation Baseline Risk Story Aggregation John synced 1029 files from Project X John was active at 6:30 pm = 95 Outputs a score between 0-100 Represents the probability that a behavior is anomalous W1 W2 Anomaly Detection Aggregates risk score to entities involved in the event - User - File - Machine - Application
- 11. 11 | © 2017 Interset Software Aggregating Behaviors for Entity Risk • Ann Funderburk works at an unusual hour 15 • … and accesses repositories that she and her peers do not usually access 65 • … and takes from a folder on a repository an unusual number of times 80 • … and moves a significantly high volume of data than normal 96 • … VPN’s in from China 46
- 12. 12 | © 2017 Interset Software The Interset Synthesis ACQUIRE DATA INGEST BASELINE LEARN CREATE ENTITY PROFILE 200+ BEHAVIORAL MODELS DETECT ANOMALIES INVESTIGATE VALIDATE REMEDIATE RISKY ENTITY 92 SIEM IAM & NETWORK ENDPOINT + DLP BUSINESS APPLICATIONS CUSTOM DATA INTERNAL RECON INFECTED HOST DATA STAGING & THEFT COMPROMISED ACCOUNT LATERAL MOVEMENT ACCOUNT MISUSE CUSTOM FRAUD Users/Accounts, Machines, Data Files, Applications, Projects Detect, measure & score anomalies. Contextual views. Drill-down and cyber-hunting. Workflow engine for incident response. Broad data collection
- 13. 13 | © 2017 Interset Software THE INTERSET APPROACH Acquire Gather the raw materials. Baseline Determine what is “normal.” Detect Find the behavior that matters. Respond Stop the threat. Now.
- 14. 14 | © 2017 Interset Software Acquire Gather the raw materials. Baseline Determine what is “normal.” Detect Find the behavior that matters. Respond Stop the threat. Now. THE INTERSET APPROACH
- 15. 15 | © 2017 Interset Software INTERSET ARCHITECTURE Kibana
- 16. 16 | © 2017 Interset Software REAL WORLD RESULTS AND LEARNINGS
- 17. 17 | © 2017 Interset Software Case Study #1: $20B Manufacturer X 2 Engineers stole data 1 Year $1 Million Spent Large security vendor failed to find anything 2 Weeks Easily identified the 2 Engineers Found 3 additional users stealing data in North America Found 8 additional users stealing data in China
- 18. 18 | © 2017 Interset Software Lesson #1: The Math Matters – Test It Too much snake oil The math matters – but the use case matters more! Don’t rely on a smoking gun Recommendations • Agree on the use cases in advance • Use a proof-of-concept with historical/existing data to test the SA’s math • Engage red team or pen testing if available • Evaluate the results: Do they support the use cases?
- 19. 19 | © 2017 Interset Software Case Study #2: Every Interset Customer Millions of events analyzed with machine learning Anomalies discovered by data science High quality “most wanted” list By analyzing the intersection of data from users, machines, files, projects, servers, sharing behavior, resource, websites, IP Addresses and more
- 20. 20 | © 2017 Interset Software Lesson #2: Less Alerts, Not More Solution should help you deal with less alerts, not more alerts Solution should leverage sound statistical methods to reduce false positives and noise Should allow you to do more with the limited resources you have Recommendations Measure and quantify the amount of work effort involved with and without the Security Analytics system
- 21. 21 | © 2017 Interset Software Case Study #3: Defense Contractor High Probability Anomalous Behavior Models Detected large copies to the portable hard drive, at an unusual time of day Bayesian models to measure and detect highly improbable events High Risk File Models Detected high risk files, including PowerPoints used to collect large amounts of inappropriate content Risk aggregation based on suspicious behaviors and unusual derivative movement
- 22. 22 | © 2017 Interset Software Lesson #3: Automated, Measured Responses Security Analytics system should allow you to quantify risk, not just a binary alert Consider how to automate responses to low, medium, high and extreme risk scenarios Where does security analytics fit into your existing runbook? Recommendations • Ensure the Security Analytics system has the ability to output a risk assessment level or score, not just a binary alert • Ensure the Security Analytics system can integrate with downstream systems • Evaluate the solution with automated response systems as part of the deployment
- 23. 23 | © 2017 Interset Software Case Study #4: Healthcare Records and Payment Profile: 6.5 billion transactions annually, 750+ customers, 500+ employees Team of 7: CISO, 1 security architect , 3 security analysts, 2 network security Analytics surfaced (for example) an employee who attempted to move “sensitive data” from endpoint to personal Dropbox Employee was arrested and prosecuted using incident dataFocus and prioritized incident responses Incident alert accuracy increased from 28% to 92% Incident mitigation coverage doubled from 70 per week to 140
- 24. 24 | © 2017 Interset Software Lesson #4: Meaningful Metrics Hawthorne Effect: Whatever gets measured, gets optimized Recommendations Define meaningful operational metrics (not just “false positives”) Build a process for measuring and quantifying over time, not just during a pilot Ensure the Security Analytics system supports a feedback process to adjust the analytics to support your target metrics
- 25. 25 | © 2017 Interset Software Considerations for a New Approach Measured Risk & Response VS Binary Risk & Response Open Integrated VS Compartmentalized Scalable Unsupervised Machine Learning VS Constrained Fast, Simple Streamlined VS Manual Obstacle Course
- 26. 26 | © 2017 Interset Software MORE INFO WWW.INTERSET.COM Paul Reid, Technology Strategist preid@interset.com www.interset.com