In this webcast, we discuss how adopting certain IT security stances, including those using log management and SIEM (Security Information and Event Management) solutions, can help you combat evolving cybersecurity threats and maintain regulatory compliance.

2. INTRODUCTION
The Security Kung Fu Series is a four-part series intended to guide you in the mastery of the art of
Security Kung Fu.
As we embarked on creating this series, we always knew that in the back of everyone’s minds were a
couple of curious thoughts: Why “Kung Fu?” And, “what does martial arts have to do with how I protect
my network?”
Well, “Kung Fu” is a Chinese term referring to any study, learning, or practice that requires patience,
energy, hard work, discipline and time to complete. So, really, it’s not just martial arts.
Perhaps, by this definition, you’re starting to see the parallels we see with IT security, and the vital roles
many of you play within your respective organizations.
For on demand access to each recording of the series visit the Security Kung Fu Series Page.
© 2017 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED. 1

3. AGENDA
• Respect your Security Kung Fu Masters
• Discuss the cybersecurity battleground
• IT security stances
• The need for a layered approach
• SIEM solutions - security and compliance
• Intro to SolarWinds® Log & Event Manager (LEM)
• Q&A
© 2017 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED. 2

4. SECURITY KUNG FU MASTERS
© 2017 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED. 3
Curtis Ingram
Sales Engineer, SolarWinds
Ian Trump
Cyber Security Strategist

5. THE CYBER SECURITY CLIMATE
© 2017 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED. 4

6. THE CYBER SECURITY CLIMATE
© 2017 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED. 5
$75 BILLION
$170 BILLION
$2 TRILLION

7. CYBER CRIME INDUSTRY
• The mature Crime-as-a-Service model underpinning cyber-crime continues to provide tools
and services across the entire spectrum of cyber criminality, from entry-level to top-level
players, including terrorists.
• The boundaries between cyber criminals, Advanced Persistent Threat (APT) style actors
and other groups continue to blur.
• The availability of cybercrime tools and services, and illicit commodities such as DDoS on
the Darknet, provide ample opportunities for traditional crime to become cyber enabled.
• Ransomware and banking Trojans remain top malware threats.
© 2017 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED. 6
Source: 2016 Internet Organised Crime Threat Assessment (IOCTA), EUROPOL

8. RECENT EXAMPLE
• IAT HONG, BO ZHENG, and CHIN HUNG
© 2017 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED. 7
Source: https://www.sec.gov/litigation/litreleases/2016/lr23711.htm

9. IT SECURITY STANCES
© 2017 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED. 8
PROACTIVE DETECTIVE REACTIVE-RECOVERY

10. PROACTIVE STANCE
• 1/3 of the best defense is to prevent breaches
altogether
o Perimeter security measures like firewalls
o Anti-virus, anti-malware, web protection, patch
management
o Harden endpoints “cyber hygiene”
o Policies/Procedures, User Awareness Training
© 2017 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED. 9

11. DETECTIVE STANCE
• 2/3 of an effective defense
o When cyber criminals are successful; there is a
requirement to catch them before data ex-filtration
takes place.
o Network layer detections, machine heuristics,
machine behavior-based metrics
o Host Intrusion Detection System
o Network Intrusion Detection System
© 2016 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED. 10

12. REACTIVE-RECOVERY STANCE
• 3/3 Restore business services
o Ransomware is the “simple” threat
o APT actors will establish footholds and move
latterly
o May require Incident Response; PR Legal, etc.
o Answer what was taken, how it was taken?
© 2017 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED. 11

13. RECENT EXAMPLES
• AUSTRAILIA’S RED CROSS® BLOOD SERVICES
© 2017 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED. 12
Source: http://theconversation.com

14. THE LAYERED SECURITY APPROACH
© 2017 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED. 13
Delivery Exploitation Installation C2 Actions
WAN to LAN End Point End Point LAN to WAN End Point
Lockheed Martin Cyber Kill Chain®

15. THE NEED FOR SIEM SOLUTIONS
• Gives you visibility in an area that is critical to your business “Threat Hunting”
• Only solution with forensic feature to go back in time
• Required for compliance and providing evidence for security audits
• Uncovers unauthorized changes in the environment
• Detects insider threats such as data ex-filtration
• Provides a record of network layer activity, correlated with machine data and
ultimately user behavior
© 2017 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED. 14

16. SOLARWINDS LOG & EVENT MANAGER
SolarWinds® Log & Event Manager is an affordable SIEM solution that helps you
detect and respond to security threats.
• Real-time event correlation for instantaneous detection of malicious and suspicious
activity
• Automated remediation and advanced search for forensic analysis and
troubleshooting
• Out-of-the-box compliance rules and reports for HIPAA, PCI, SOX, FISMA, and may
more.
Download Free Trial | Learn More
© 2017 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED. 15

18. SECURITY KUNG FU WEBINAR SERIES
© 2017 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED. 17
The SolarWinds, SolarWinds & Design, Orion, and Thwack trademarks are the exclusive
property of SolarWinds Worldwide, LLC or its affiliates, are registered with the U.S. Patent
and Trademark Office, and may be registered or pending registration in other countries. All
other SolarWinds trademarks, service marks, and logos may be common law marks or are
registered or pending registration. All other trademarks mentioned herein are used for
identification purposes only and are trademarks of (and may be registered trademarks) of
their respective companies.