Preparing for the Cybersecurity Renaissance
•
1 gefällt mir•1,172 views
We are in the midst of a fundamental shift in the way in which organizations protect themselves from the modern adversary. Traditional rules based cybersecurity applications of the past are not able to protect organizations in the new mobile, social, and hyper-connected world they now operate within. However, the convergence of big data technology, analytic advancements, and a variety of other factors have sparked a cybersecurity renaissance that will forever change the way in which organizations protect themselves. Join Rocky DeStefano, Cloudera's Cybersecurity subject matter expert, as he explores how modern organizations are protecting themselves from more frequent, sophisticated attacks. During this webinar you will learn about: The current challenges cybersecurity professionals are facing today How big data technologies are extending the capabilities of cybersecurity applications Cloudera customers that are future proofing their cybersecurity posture with Cloudera’s next generation data and analytics management system
Empfohlen
Empfohlen
Weitere ähnliche Inhalte
Was ist angesagt?
Was ist angesagt? (20)
Andere mochten auch
Andere mochten auch (17)
Ähnlich wie Preparing for the Cybersecurity Renaissance
Ähnlich wie Preparing for the Cybersecurity Renaissance (20)
Mehr von Cloudera, Inc.
Mehr von Cloudera, Inc. (20)
Kürzlich hochgeladen
Kürzlich hochgeladen (20)
Preparing for the Cybersecurity Renaissance
- 1. 1© Cloudera, Inc. All rights reserved. Preparing for the Cybersecurity Renaissance Futureproofing cybersecurity analysis
- 2. 2© Cloudera, Inc. All rights reserved. Agenda • Housekeeping • Introductions • Presentation • Live Q&A
- 3. 3© Cloudera, Inc. All rights reserved. Rocky DeStefano Cloudera Subject Matter Expert, Cybersecurity
- 4. 4© Cloudera, Inc. All rights reserved. Security Operations Data left out of process Expensive to scale systems Proprietary tooling makes difficult to implement new Security Analysts Out of the box analytics Signature based is yesterdays threat Advanced analytics are add-ons Security Responders Data can take weeks to retrieve Raw and historic data offline Reactive instead of predictive Challenges with traditional threat detection
- 5. 5© Cloudera, Inc. All rights reserved. Current state of cybersecurity Aggregated Events Raw System Logs Network Flows/ DNS Full Packet Capture Video, Text, Images User Data Data Types (MBs>PBs) SIEM (TBs) Search Correlations SQL Machine Learning Advanced Statistics 1 10 20 40 Time (Months) 3
- 6. 6© Cloudera, Inc. All rights reserved. The shift to Apache Hadoop has already begun…
- 7. 7© Cloudera, Inc. All rights reserved. Powering the next generation of cybersecurity Aggregated Events Raw System Logs Network Flows/ DNS Full Packet Capture Video, Text, Images User Data Data Types (MBs>PBs) Search Correlations SQL Machine Learning Advanced Statistics 1 10 20 40 Time (Months) 3 SIEM (TBs) Apache Hadoop Based Applications (PB)
- 8. 8© Cloudera, Inc. All rights reserved. Enhanced Visibility, Depth and Coverage Network Flows Sessions PCAP File Executable PDF DOC Endpoint DLL Processes Memory Context Threat Intel Context Threat Intell Vuln Business User Admin User Service Complete Enterprise Visibility Logs System Network Alerts Applications Mobile Cloud Enterprise Process Executable
- 9. 9© Cloudera, Inc. All rights reserved. Security Operations Keep data online forever Process larger volumes of diverse data Security Analysts Native SQL, Statistical, Machine Learning capabilities Advanced Persistent Threat detection Security Responders Make data accessible immediately Provide raw and enriched data access Benefits of modern threat detection
- 10. 10© Cloudera, Inc. All rights reserved. Maturing cybersecurity Detection Primary Goals: Reduce Time to Identification Reduce Time to Response Understand Impact Benefits: Maximize Effectiveness Limit Impact / Reduce Risk Better Decisions and Proactive Stance These measurements will expose gaps in visibility, technology, training and process as well as any misalignment with the business objectives.
- 11. 11© Cloudera, Inc. All rights reserved. Evolving cybersecurity analytic capabilities ComplexityofDetection Alerts Files Commodity Targeted Search Alerting Incident Response Hunting Forensics Validation Compliance Advanced Insider Logs Network Endpoint User Information Sources The ever increasing complexity of attacks and the ever evolving nature of our data and systems forces a new approach to security. There is an undisputable need for more data and the equivalent analytic flexibility to process that data.
- 12. 12© Cloudera, Inc. All rights reserved. Summarizing The Keys to Effective Detection Enterprise Visibility Context Speed Analytics Expertise Complete instrumentation and access to all data. Endpoints, Networks, Logs, Applications, Users, Files, etc Asset Information, User Information, Threat Intelligence, Vulnerability, Business Function, Systems/Application/Data Ownership and Criticality, Adversaries adjust in seconds, Enterprises need to evolve at a similar speed. Access to all applicable data and the tools to analyze the data at scale, across all timelines and with flexible analytic methods. Security Analysis, ML, Forensics, Malware Reversing, Impact Assessment, Enterprise Architecture, etc. Process Standardized, communicated, trained and robust enough to flex when necessary.
- 13. 13© Cloudera, Inc. All rights reserved. The fastest, easiest, and most secure platform Powerful Cluster Ops Trusted by the pros Cloud & Hybrid deployment Integrated with AWS & Azure Expert Support Dedicated predictive support, just a click away Easy to ManageFast for Business Security without Compromise Enterprise Encryption Protects everything transparently Access Policy Enforcement Full-stack row/column-based RBAC & dynamic masking Automated Data Management Full-stack audit, lineage, discovery, and lifecycle Real-Time Processing Lowest latency, best concurrency The Fastest Analytic SQL Lowest latency, best concurrency Machine Learning at Scale Spark reduces ML processing time
- 14. 14© Cloudera, Inc. All rights reserved. Next generation cyber solutions choose Cloudera
- 15. 15© Cloudera, Inc. All rights reserved. Introducing Open Network Insight (ONI) Apache 2.0 Licensed • Apache Hadoop on Intel platform delivers unrivaled analytic performance and scale • ONI open data models place customer in control of the data unlocking tremendous value • ONI application framework accelerates development and delivery of adjacent use cases built on open data models • Robust community Network Endpoint User / Identity Apache Hadoop Intel Platform
- 16. 16© Cloudera, Inc. All rights reserved. Open Network Insight (ONI) V1.0 Apache 2.0 Licensed ONI for cybersecurity difference… • Analyze billions of network events per day leveraging machine learning in order to detect unknown events, insider attacks, and diagnose dark areas • Reduce false positive alerts by triangulating the data with context to assure the alerts you receive are legitimate • Provide meaningful insights by analyzing the data (e.g., flow, DNS packet) that is already being collected
- 17. Port 143 IMAP Port 143 IMAP Use Case: Hidden Networks and Suspicious Connects Identify the needle in the haystack with patterns that provide insight into potential threats. How can I find the bad mixed in with all the good? Human input helps the system evolve. Quickly eliminate false positives from the lineup. And make every item on the list worth your time to investigate. Advanced Analytics Algorithms Take action Monitor Ignore Deliver suspicious connections in ranked order with multiple data points such as time, traffic flow, and more. 1 2 3 4 5 Port 80 HTTP Suspicious!
- 18. 18 Path to Enlightenment – ONI v 1.0 perimeter flows perimeter flows + DNS perimeter flows + DNS + internal flows (Stealthy) Scanning Side-channel data escapes Reflection attacks Unusual data flows Beaconing DNS tunneling Covert DNS channels Internal DNS recon Lateral movement Complete threat visibility
- 19. 19 From raw packets to the most actionable events Operational Analytics Network Flows (nfcapd) Parallel Ingest Framework DNS (pcap) Machine Learning Sensors feed ONI • Open Source Decoders • Creates CSV and Compressed data in HDFS • Filters billions to thousands • Baseline not required • Unsupervised, no rules required • Returns small number of credible threats from machine learning • Visualization, Noise Filter, Attack Heuristics Each data source is a pipeline – new pipelines can be added by following a short “recipe”
- 20. 20© Cloudera, Inc. All rights reserved.
- 21. 21© Cloudera, Inc. All rights reserved. THE platform for cybersecurity analytics Partner Benefit Customer Benefit CDH on Intel Hardware - Leading edge capabilities - Best developer support - Fastest, easiest, most secure platform Open Network Insight (Apache 2.0 licensed) - Accelerated time to market - Invest in solution, not plumbing - Data control and ownership - Interoperable solutions Cloudera Manager and Director - Built in solution deployment / management / monitoring platform - Simple, hybrid deployments - Common console for all solutions Customer and Partner Communities - Largest customer base - Most certified solutions
- 22. 22© Cloudera, Inc. All rights reserved. The Apache Software FoundationTM 2006 2008 2009 2010 2011 2012 Present Core Hadoop (HDFS, MR) HBase ZooKeeper Core Hadoop Hive Pig Mahout HBase ZooKeeper Core Hadoop Sqoop Whirr Avro Hive Pig Mahout HBase ZooKeeper Core Hadoop Flume Bigtop Oozie MRUnit HCatalog Sqoop Whirr Avro Hive Pig Mahout HBase ZooKeeper Spark Impala Solr Kafka Flume Bigtop Oozie MRUnit HCatalog Sqoop Whirr Avro Hive Pig Mahout HBase ZooKeeper Parquet Sentry Spark Impala Solr Kafka Flume Bigtop Oozie MRUnit HCatalog Sqoop Whirr Avro Hive Pig Mahout HBase ZooKeeper Core Hadoop +YARN Core Hadoop +YARN Core Hadoop +YARN Hadoop is so much more than just Hadoop.
- 23. 23© Cloudera, Inc. All rights reserved. Our customers have already seen success.
- 24. 24© Cloudera, Inc. All rights reserved. Consumer credit provider building detection models using a full year of comprehensive log and indicator data
- 25. 25© Cloudera, Inc. All rights reserved. US Bank leveraging user behavior analytics to detect fraud and inside user threats
- 26. 26© Cloudera, Inc. All rights reserved. A US national security organization identifies potentially suspicious activity across the worldwide web, and supply threat information to 700 commercial and federal organizations.
- 27. 27© Cloudera, Inc. All rights reserved. CRM provider using comprehensive log archive provides immediate availability to support investigation and mitigation
- 28. 28© Cloudera, Inc. All rights reserved. Live Q&A Please enter your questions in the chat box…
- 29. 29© Cloudera, Inc. All rights reserved. Thank you.
Hinweis der Redaktion
- HP ArcSight: https://www.protect724.hpe.com/docs/DOC-12978 Splunk (Hadoop Connect): http://www.splunk.com/en_us/solutions/solution-areas/big-data/splunk-hadoop-connect.html Export events from Splunk to Hadoop Browser directories and files in Hadoop Index data from Splunk in Hadoop for secure search, visualization, analytics Qradar: https://www.ibm.com/.../Integrating_QRadar_with_Hadoop.pdf
- A starting point on files: PDF EXE JAVA PCAP PE Files RAR ZIP SWF MS Office RTF MHTML YARA Mach-O XOR
- Every Hadoop platform gives you scalability and flexibility. Cloudera makes Hadoop fast, easy, and secure. Trap Questions: Spark: What matters to you in supporting Spark and Hadoop? Impala: How many BI users will you have? What additional budget have you allocated for Hive? Kudu: How do you plan to address operational data warehouse / time series use cases? Cloudera Navigator Optimizer: How do you know what data should be in Hadoop vs existing systems? Trap Questions: Cloudera Manager: How much downtime are you willing to accept during an upgrade? What if your operations tools fail during an outage? What does your team need to debug critical and latent issues? Cloudera Director: Where is your data being created? How do you plan to manage across environments? Are you prepared to train staff on both Amazon and on-premises Hadoop platforms? Expert Support: How can a core R&D group simultaneously respond to frequent customer issues and also build a culture of innovation? [only Cloudera has a back-line support team to address issues without bringing in R&D] Trap Questions: Navigator Encrypt/KeyTrustee: What is the impact of an information leak from intermediate MR results, log files, etc? Sentry/RecordService: How are you planning to secure access to sensitive data across Hive and Spark? Navigator: Do your governance needs extend beyond Hive? Manager: How will you keep end users from damaging your production environments?
- Merge slide 12 and 10 without categorization on the vendors
- Cybersecurity application framework Abnormal traffic patterns analyzing network flow and dns with machine learning Open data models for network Community to extend
- Find the needle in the haystack. Note: slideshow mode builds image in the following sequence: 1. You can see all the connections, but which are suspicious? 2. Netflow data is sent through the advanced algorithms 3. The algorithms identify the most likely candidates for further investigation 4. The suspicious connections are ranked and given to a human to analyze 5. The human determines what actions to take toward each item 6. Feedback then makes the system grow smarter and more useful
- Misconfigurations, network problems you didn’t know about. Security and misconfigurations account for an enormous part of what they do. Its all fire fighting. Things are either operational or security not both.
- First and foremost we have the Apache Hadoop community. This ever growing community continues to grow as Hadoop continues to expand out of just batch storage and processing. As more businesses continue to use Hadoop, more use cases continue to emerge creating additional projects that allow for more robust data applications. With Hadoop you don’t just get the code your team built, you get the code the community built.
- Link to account record in SFDC (for Cloudera employees only): https://na6.salesforce.com/0018000000oqdOF?srPos=0&srKp=001 A national security organization in the US offers real-time information, warnings and guidelines that strengthen our ability to protect against cyber attacks. Background: In today’s digital world, cyber security is a serious effort. A US national security organization is tasked with identifying potentially suspicious activity across the worldwide web, and they must make that information available to 700 commercial and federal organizations. Challenge: More data lends itself to more accurate predictions, so logically the organization has been collecting massive volumes of cyber data in order to prevent cyber attacks. But their incumbent IBM Netezza environment was hitting scalability and performance limitations. Solution: The organization deployed a Cloudera Enterprise platform with Sherpasurfing, an open source cyber security solution created by Six3 Systems. Cloudera runs data processing, staging and storage; the Cloudera environment is integrated with Netezza which performs analytics. The system is also integrated with HP ArcSite, Tableau and Centrifuge. Hadoop components in use include Accumulo, Hive, Flume, MapReduce and Sqoop. This organization is growing their Cloudera cluster to 100 PB. Results: Since deploying Cloudera alongside Netezza, this organization can offer real-time information and warnings to other government organizations. They can also now show rich information on major malware outbreaks and provide guidelines to strengthen organizations’ protection against cyber attacks -- this is a net new capability that resulted from their Cloudera deployment.