SlideShare ist ein Scribd-Unternehmen logo

Visual Analytics and Security Intelligence

Big data and security intelligence are the two hot security topics in 2012. We are collecting more and more information from both the infrastructure, but increasingly also directly from our applications. Some companies are moving away from traditional log management and SIEM tools and are deploying big data products. But what is this big data craze all about? Why is it that we have more and more data to look at? And is big data the right approach or what is missing? The presentation takes the audience on a journey through big data tools and show that analytical tools are needed to make use of these infrastructures. How can visualization be used to fill in the gap in analytics to move into gaining situational awareness and building up security intelligence.

1 von 35
Downloaden Sie, um offline zu lesen
Visual Analytics and
                        Security Intelligence
                                    Big Data in Action
                                   Nordic Security Conference - August 2012
                                                Raffael Marty

pixlcloud |   creating big data stories                                       copyright (c) 2012
Doushuai's Three Barriers
‘You	 make	 your	 way	 through	 the	 darkness	 of	 abandoned	 grasses	 in	 a	 
       search	 for	 meaning.	 As	 you	 do,	 where	 is	 the	 meaning?'




                                                       47th case of'The Gateless Barrier'
                                                            a collection of Zen koans
Raffael Marty
                        13 years in the log analysis and information visualization space

    • Founder and CEO @ pixlcloud
    • Founder and COO @ Loggly
    • Chief Security Strategist and Product Manager @ Splunk
    • Manager Solutions @ ArcSight
    • Intrusion Detection Research @ IBM Research
    • IT Security Consultant @ PriceWaterhouse Coopers




pixlcloud |   turning data into actionable insights                                        copyright © 2012
Security Intelligence
    • Where  We Wanna Be
    • SIEM, log management
    • Changing IT
    • Did SIEM keep pace?
    • What’s still missing?
    • Security Intelligence and Big Data


pixlcloud |   creating actionable data insights         copyright (c) 2012
Oblong Industries

pixlcloud |   creating big data stories              copyright (c) 2012
http://www.agi.com
pixlcloud |   creating big data stories            copyright (c) 2012
Anzeige

Recomendados

Cyber Security – How Visual Analytics Unlock Insight
Cyber Security – How Visual Analytics Unlock InsightCyber Security – How Visual Analytics Unlock Insight
Cyber Security – How Visual Analytics Unlock InsightRaffael Marty
 
Log Visualization - Bellua BCS 2006
Log Visualization - Bellua BCS 2006Log Visualization - Bellua BCS 2006
Log Visualization - Bellua BCS 2006Raffael Marty
 
Cloud - Security - Big Data
Cloud - Security - Big DataCloud - Security - Big Data
Cloud - Security - Big DataRaffael Marty
 
Security Visualization - Let's Take A Step Back
Security Visualization - Let's Take A Step BackSecurity Visualization - Let's Take A Step Back
Security Visualization - Let's Take A Step BackRaffael Marty
 
Supercharging Visualization with Data Mining
Supercharging Visualization with Data MiningSupercharging Visualization with Data Mining
Supercharging Visualization with Data MiningRaffael Marty
 
Data Security Solutions - Cyber Security & Security Intelligence - @ Lithuani...
Data Security Solutions - Cyber Security & Security Intelligence - @ Lithuani...Data Security Solutions - Cyber Security & Security Intelligence - @ Lithuani...
Data Security Solutions - Cyber Security & Security Intelligence - @ Lithuani...Andris Soroka
 
RSA 2006 - Visual Security Event Analysis
RSA 2006 - Visual Security Event AnalysisRSA 2006 - Visual Security Event Analysis
RSA 2006 - Visual Security Event AnalysisRaffael Marty
 
Creating Your Own Threat Intel Through Hunting & Visualization
Creating Your Own Threat Intel Through Hunting & VisualizationCreating Your Own Threat Intel Through Hunting & Visualization
Creating Your Own Threat Intel Through Hunting & VisualizationRaffael Marty
 

Más contenido relacionado

Destacado

SplunkLive Melbourne Splunk for Operational Security Intelligence
SplunkLive Melbourne Splunk for Operational Security Intelligence SplunkLive Melbourne Splunk for Operational Security Intelligence
SplunkLive Melbourne Splunk for Operational Security Intelligence Splunk
 
Security Insights at Scale
Security Insights at ScaleSecurity Insights at Scale
Security Insights at ScaleRaffael Marty
 
Big Data Security Intelligence and Analytics for Advanced Threat Protection
Big Data Security Intelligence and Analytics for Advanced Threat ProtectionBig Data Security Intelligence and Analytics for Advanced Threat Protection
Big Data Security Intelligence and Analytics for Advanced Threat ProtectionBlue Coat
 
Creating Your Own Threat Intel Through Hunting & Visualization
Creating Your Own Threat Intel Through Hunting & VisualizationCreating Your Own Threat Intel Through Hunting & Visualization
Creating Your Own Threat Intel Through Hunting & VisualizationRaffael Marty
 
Key Findings from the 2015 IBM Cyber Security Intelligence Index
Key Findings from the 2015 IBM Cyber Security Intelligence IndexKey Findings from the 2015 IBM Cyber Security Intelligence Index
Key Findings from the 2015 IBM Cyber Security Intelligence IndexIBM Security
 
RSA: Security Analytics Architecture for APT
RSA: Security Analytics Architecture for APTRSA: Security Analytics Architecture for APT
RSA: Security Analytics Architecture for APTLee Wei Yeong
 
AI & ML in Cyber Security - Welcome Back to 1999 - Security Hasn't Changed
AI & ML in Cyber Security - Welcome Back to 1999 - Security Hasn't ChangedAI & ML in Cyber Security - Welcome Back to 1999 - Security Hasn't Changed
AI & ML in Cyber Security - Welcome Back to 1999 - Security Hasn't ChangedRaffael Marty
 

Destacado (7)

SplunkLive Melbourne Splunk for Operational Security Intelligence
SplunkLive Melbourne Splunk for Operational Security Intelligence SplunkLive Melbourne Splunk for Operational Security Intelligence
SplunkLive Melbourne Splunk for Operational Security Intelligence
 
Security Insights at Scale
Security Insights at ScaleSecurity Insights at Scale
Security Insights at Scale
 
Big Data Security Intelligence and Analytics for Advanced Threat Protection
Big Data Security Intelligence and Analytics for Advanced Threat ProtectionBig Data Security Intelligence and Analytics for Advanced Threat Protection
Big Data Security Intelligence and Analytics for Advanced Threat Protection
 
Creating Your Own Threat Intel Through Hunting & Visualization
Creating Your Own Threat Intel Through Hunting & VisualizationCreating Your Own Threat Intel Through Hunting & Visualization
Creating Your Own Threat Intel Through Hunting & Visualization
 
Key Findings from the 2015 IBM Cyber Security Intelligence Index
Key Findings from the 2015 IBM Cyber Security Intelligence IndexKey Findings from the 2015 IBM Cyber Security Intelligence Index
Key Findings from the 2015 IBM Cyber Security Intelligence Index
 
RSA: Security Analytics Architecture for APT
RSA: Security Analytics Architecture for APTRSA: Security Analytics Architecture for APT
RSA: Security Analytics Architecture for APT
 
AI & ML in Cyber Security - Welcome Back to 1999 - Security Hasn't Changed
AI & ML in Cyber Security - Welcome Back to 1999 - Security Hasn't ChangedAI & ML in Cyber Security - Welcome Back to 1999 - Security Hasn't Changed
AI & ML in Cyber Security - Welcome Back to 1999 - Security Hasn't Changed
 

Ähnlich wie Visual Analytics and Security Intelligence

Cyber Crime leeds to Tape Air-Gap Protection
Cyber Crime leeds to Tape Air-Gap ProtectionCyber Crime leeds to Tape Air-Gap Protection
Cyber Crime leeds to Tape Air-Gap ProtectionJosef Weingand
 
20131203 11 pivotal_ wie_big_data_geschäftsmodelle_verändert
20131203 11 pivotal_ wie_big_data_geschäftsmodelle_verändert20131203 11 pivotal_ wie_big_data_geschäftsmodelle_verändert
20131203 11 pivotal_ wie_big_data_geschäftsmodelle_verändertWerbeplanung.at Summit
 
Sicherheitsbetrachtung der Cloudifizierung von Smart- Devices
Sicherheitsbetrachtung der Cloudifizierung von Smart- DevicesSicherheitsbetrachtung der Cloudifizierung von Smart- Devices
Sicherheitsbetrachtung der Cloudifizierung von Smart- DevicesConnected-Blog
 
AiKomPass: Digitalkompetenzen erfassen
AiKomPass: Digitalkompetenzen erfassenAiKomPass: Digitalkompetenzen erfassen
AiKomPass: Digitalkompetenzen erfassenMatthias Binder
 
Deep Learning – The Future of AI
Deep Learning – The Future of AIDeep Learning – The Future of AI
Deep Learning – The Future of AIGroupeT2i
 
Google Analytics Konferenz 2015_Building a data strategy_Georg Koch_herold.at
Google Analytics Konferenz 2015_Building a data strategy_Georg Koch_herold.atGoogle Analytics Konferenz 2015_Building a data strategy_Georg Koch_herold.at
Google Analytics Konferenz 2015_Building a data strategy_Georg Koch_herold.ate-dialog GmbH
 
Verwandeln Sie Big Data in Verkaufserfolg! | 
Dr. Dorian Selz, Co-Founder & C...
Verwandeln Sie Big Data in Verkaufserfolg! | 
Dr. Dorian Selz, Co-Founder & C...Verwandeln Sie Big Data in Verkaufserfolg! | 
Dr. Dorian Selz, Co-Founder & C...
Verwandeln Sie Big Data in Verkaufserfolg! | 
Dr. Dorian Selz, Co-Founder & C...topsoft - inspiring digital business
 
Belsoft Collaboration Day 2018 - IBM Think, die neue Konferenz
Belsoft Collaboration Day 2018 - IBM Think, die neue KonferenzBelsoft Collaboration Day 2018 - IBM Think, die neue Konferenz
Belsoft Collaboration Day 2018 - IBM Think, die neue KonferenzBelsoft
 
Die Experton Big Data Studie und Splunk
Die Experton Big Data Studie und SplunkDie Experton Big Data Studie und Splunk
Die Experton Big Data Studie und SplunkGeorg Knon
 
Dotnet Cologne 2015: //Rebuild - Big Data Analysis End-to-End
Dotnet Cologne 2015: //Rebuild - Big Data Analysis End-to-EndDotnet Cologne 2015: //Rebuild - Big Data Analysis End-to-End
Dotnet Cologne 2015: //Rebuild - Big Data Analysis End-to-EndOlivia Klose
 
Big-Data solutions based on cyber-physical-systems: Is Industrie 4.0 applicab...
Big-Data solutions based on cyber-physical-systems: Is Industrie 4.0 applicab...Big-Data solutions based on cyber-physical-systems: Is Industrie 4.0 applicab...
Big-Data solutions based on cyber-physical-systems: Is Industrie 4.0 applicab...Sebastian Scholze
 
Sicherheitsaspekte bei der Einführung von BYOD in Unternehmen
Sicherheitsaspekte bei der Einführung von BYOD in UnternehmenSicherheitsaspekte bei der Einführung von BYOD in Unternehmen
Sicherheitsaspekte bei der Einführung von BYOD in Unternehmenphilippkumar
 
20181120_DOAG_OracleNoSQLDB_KPatenge
20181120_DOAG_OracleNoSQLDB_KPatenge20181120_DOAG_OracleNoSQLDB_KPatenge
20181120_DOAG_OracleNoSQLDB_KPatengeKarin Patenge
 
Der Weg in den vollautomatisierten SOC Betrieb
Der Weg in den vollautomatisierten SOC BetriebDer Weg in den vollautomatisierten SOC Betrieb
Der Weg in den vollautomatisierten SOC BetriebSplunk
 
5 lukas ruf hacking in the cloud
5 lukas ruf  hacking in the cloud5 lukas ruf  hacking in the cloud
5 lukas ruf hacking in the cloudDigicomp Academy AG
 
Big data trend oder hype slideshare
Big data   trend oder hype slideshareBig data   trend oder hype slideshare
Big data trend oder hype slideshareGuido Oswald
 
Rückblick Big Data Minds 2013
Rückblick Big Data Minds 2013Rückblick Big Data Minds 2013
Rückblick Big Data Minds 2013Maria Willamowius
 

Ähnlich wie Visual Analytics and Security Intelligence (20)

Cyber Crime leeds to Tape Air-Gap Protection
Cyber Crime leeds to Tape Air-Gap ProtectionCyber Crime leeds to Tape Air-Gap Protection
Cyber Crime leeds to Tape Air-Gap Protection
 
20131203 11 pivotal_ wie_big_data_geschäftsmodelle_verändert
20131203 11 pivotal_ wie_big_data_geschäftsmodelle_verändert20131203 11 pivotal_ wie_big_data_geschäftsmodelle_verändert
20131203 11 pivotal_ wie_big_data_geschäftsmodelle_verändert
 
Sicherheitsbetrachtung der Cloudifizierung von Smart- Devices
Sicherheitsbetrachtung der Cloudifizierung von Smart- DevicesSicherheitsbetrachtung der Cloudifizierung von Smart- Devices
Sicherheitsbetrachtung der Cloudifizierung von Smart- Devices
 
AiKomPass: Digitalkompetenzen erfassen
AiKomPass: Digitalkompetenzen erfassenAiKomPass: Digitalkompetenzen erfassen
AiKomPass: Digitalkompetenzen erfassen
 
Deep Learning – The Future of AI
Deep Learning – The Future of AIDeep Learning – The Future of AI
Deep Learning – The Future of AI
 
Google Analytics Konferenz 2015_Building a data strategy_Georg Koch_herold.at
Google Analytics Konferenz 2015_Building a data strategy_Georg Koch_herold.atGoogle Analytics Konferenz 2015_Building a data strategy_Georg Koch_herold.at
Google Analytics Konferenz 2015_Building a data strategy_Georg Koch_herold.at
 
Verwandeln Sie Big Data in Verkaufserfolg! | 
Dr. Dorian Selz, Co-Founder & C...
Verwandeln Sie Big Data in Verkaufserfolg! | 
Dr. Dorian Selz, Co-Founder & C...Verwandeln Sie Big Data in Verkaufserfolg! | 
Dr. Dorian Selz, Co-Founder & C...
Verwandeln Sie Big Data in Verkaufserfolg! | 
Dr. Dorian Selz, Co-Founder & C...
 
Belsoft Collaboration Day 2018 - IBM Think, die neue Konferenz
Belsoft Collaboration Day 2018 - IBM Think, die neue KonferenzBelsoft Collaboration Day 2018 - IBM Think, die neue Konferenz
Belsoft Collaboration Day 2018 - IBM Think, die neue Konferenz
 
Die Experton Big Data Studie und Splunk
Die Experton Big Data Studie und SplunkDie Experton Big Data Studie und Splunk
Die Experton Big Data Studie und Splunk
 
IT Trends 2011 - und welchen Einfluss Business Analytics darauf hat
IT Trends 2011 - und welchen Einfluss Business Analytics darauf hatIT Trends 2011 - und welchen Einfluss Business Analytics darauf hat
IT Trends 2011 - und welchen Einfluss Business Analytics darauf hat
 
Innovative Produktpräsentation und mehr
Innovative Produktpräsentation und mehrInnovative Produktpräsentation und mehr
Innovative Produktpräsentation und mehr
 
Dotnet Cologne 2015: //Rebuild - Big Data Analysis End-to-End
Dotnet Cologne 2015: //Rebuild - Big Data Analysis End-to-EndDotnet Cologne 2015: //Rebuild - Big Data Analysis End-to-End
Dotnet Cologne 2015: //Rebuild - Big Data Analysis End-to-End
 
Big-Data solutions based on cyber-physical-systems: Is Industrie 4.0 applicab...
Big-Data solutions based on cyber-physical-systems: Is Industrie 4.0 applicab...Big-Data solutions based on cyber-physical-systems: Is Industrie 4.0 applicab...
Big-Data solutions based on cyber-physical-systems: Is Industrie 4.0 applicab...
 
Sicherheitsaspekte bei der Einführung von BYOD in Unternehmen
Sicherheitsaspekte bei der Einführung von BYOD in UnternehmenSicherheitsaspekte bei der Einführung von BYOD in Unternehmen
Sicherheitsaspekte bei der Einführung von BYOD in Unternehmen
 
20181120_DOAG_OracleNoSQLDB_KPatenge
20181120_DOAG_OracleNoSQLDB_KPatenge20181120_DOAG_OracleNoSQLDB_KPatenge
20181120_DOAG_OracleNoSQLDB_KPatenge
 
Der Weg in den vollautomatisierten SOC Betrieb
Der Weg in den vollautomatisierten SOC BetriebDer Weg in den vollautomatisierten SOC Betrieb
Der Weg in den vollautomatisierten SOC Betrieb
 
Peter Hanke (Netapp Austria)
Peter Hanke (Netapp Austria)Peter Hanke (Netapp Austria)
Peter Hanke (Netapp Austria)
 
5 lukas ruf hacking in the cloud
5 lukas ruf  hacking in the cloud5 lukas ruf  hacking in the cloud
5 lukas ruf hacking in the cloud
 
Big data trend oder hype slideshare
Big data   trend oder hype slideshareBig data   trend oder hype slideshare
Big data trend oder hype slideshare
 
Rückblick Big Data Minds 2013
Rückblick Big Data Minds 2013Rückblick Big Data Minds 2013
Rückblick Big Data Minds 2013
 

Mehr von Raffael Marty

Exploring the Defender's Advantage
Exploring the Defender's AdvantageExploring the Defender's Advantage
Exploring the Defender's AdvantageRaffael Marty
 
Extended Detection and Response (XDR) An Overhyped Product Category With Ulti...
Extended Detection and Response (XDR)An Overhyped Product Category With Ulti...Extended Detection and Response (XDR)An Overhyped Product Category With Ulti...
Extended Detection and Response (XDR) An Overhyped Product Category With Ulti...Raffael Marty
 
How To Drive Value with Security Data
How To Drive Value with Security DataHow To Drive Value with Security Data
How To Drive Value with Security DataRaffael Marty
 
Cyber Security Beyond 2020 – Will We Learn From Our Mistakes?
Cyber Security Beyond 2020 – Will We Learn From Our Mistakes?Cyber Security Beyond 2020 – Will We Learn From Our Mistakes?
Cyber Security Beyond 2020 – Will We Learn From Our Mistakes?Raffael Marty
 
Artificial Intelligence – Time Bomb or The Promised Land?
Artificial Intelligence – Time Bomb or The Promised Land?Artificial Intelligence – Time Bomb or The Promised Land?
Artificial Intelligence – Time Bomb or The Promised Land?Raffael Marty
 
Understanding the "Intelligence" in AI
Understanding the "Intelligence" in AIUnderstanding the "Intelligence" in AI
Understanding the "Intelligence" in AIRaffael Marty
 
AI & ML in Cyber Security - Why Algorithms are Dangerous
AI & ML in Cyber Security - Why Algorithms are DangerousAI & ML in Cyber Security - Why Algorithms are Dangerous
AI & ML in Cyber Security - Why Algorithms are DangerousRaffael Marty
 
AI & ML in Cyber Security - Why Algorithms Are Dangerous
AI & ML in Cyber Security - Why Algorithms Are DangerousAI & ML in Cyber Security - Why Algorithms Are Dangerous
AI & ML in Cyber Security - Why Algorithms Are DangerousRaffael Marty
 
Delivering Security Insights with Data Analytics and Visualization
Delivering Security Insights with Data Analytics and VisualizationDelivering Security Insights with Data Analytics and Visualization
Delivering Security Insights with Data Analytics and VisualizationRaffael Marty
 
Visualization in the Age of Big Data
Visualization in the Age of Big DataVisualization in the Age of Big Data
Visualization in the Age of Big DataRaffael Marty
 
Big Data Visualization
Big Data VisualizationBig Data Visualization
Big Data VisualizationRaffael Marty
 
The Heatmap
 - Why is Security Visualization so Hard?
The Heatmap
 - Why is Security Visualization so Hard?The Heatmap
 - Why is Security Visualization so Hard?
The Heatmap
 - Why is Security Visualization so Hard?Raffael Marty
 
Workshop: Big Data Visualization for Security
Workshop: Big Data Visualization for SecurityWorkshop: Big Data Visualization for Security
Workshop: Big Data Visualization for SecurityRaffael Marty
 
Visualization for Security
Visualization for SecurityVisualization for Security
Visualization for SecurityRaffael Marty
 
The Heatmap
 - Why is Security Visualization so Hard?
The Heatmap
 - Why is Security Visualization so Hard?The Heatmap
 - Why is Security Visualization so Hard?
The Heatmap
 - Why is Security Visualization so Hard?Raffael Marty
 
DAVIX - Data Analysis and Visualization Linux
DAVIX - Data Analysis and Visualization LinuxDAVIX - Data Analysis and Visualization Linux
DAVIX - Data Analysis and Visualization LinuxRaffael Marty
 
Event Graphs - EUSecWest 2006
Event Graphs - EUSecWest 2006Event Graphs - EUSecWest 2006
Event Graphs - EUSecWest 2006Raffael Marty
 
Insider Threat Visualization - HackInTheBox 2007
Insider Threat Visualization - HackInTheBox 2007Insider Threat Visualization - HackInTheBox 2007
Insider Threat Visualization - HackInTheBox 2007Raffael Marty
 

Mehr von Raffael Marty (20)

Exploring the Defender's Advantage
Exploring the Defender's AdvantageExploring the Defender's Advantage
Exploring the Defender's Advantage
 
Extended Detection and Response (XDR) An Overhyped Product Category With Ulti...
Extended Detection and Response (XDR)An Overhyped Product Category With Ulti...Extended Detection and Response (XDR)An Overhyped Product Category With Ulti...
Extended Detection and Response (XDR) An Overhyped Product Category With Ulti...
 
How To Drive Value with Security Data
How To Drive Value with Security DataHow To Drive Value with Security Data
How To Drive Value with Security Data
 
Cyber Security Beyond 2020 – Will We Learn From Our Mistakes?
Cyber Security Beyond 2020 – Will We Learn From Our Mistakes?Cyber Security Beyond 2020 – Will We Learn From Our Mistakes?
Cyber Security Beyond 2020 – Will We Learn From Our Mistakes?
 
Artificial Intelligence – Time Bomb or The Promised Land?
Artificial Intelligence – Time Bomb or The Promised Land?Artificial Intelligence – Time Bomb or The Promised Land?
Artificial Intelligence – Time Bomb or The Promised Land?
 
Understanding the "Intelligence" in AI
Understanding the "Intelligence" in AIUnderstanding the "Intelligence" in AI
Understanding the "Intelligence" in AI
 
Security Chat 5.0
Security Chat 5.0Security Chat 5.0
Security Chat 5.0
 
AI & ML in Cyber Security - Why Algorithms are Dangerous
AI & ML in Cyber Security - Why Algorithms are DangerousAI & ML in Cyber Security - Why Algorithms are Dangerous
AI & ML in Cyber Security - Why Algorithms are Dangerous
 
AI & ML in Cyber Security - Why Algorithms Are Dangerous
AI & ML in Cyber Security - Why Algorithms Are DangerousAI & ML in Cyber Security - Why Algorithms Are Dangerous
AI & ML in Cyber Security - Why Algorithms Are Dangerous
 
Delivering Security Insights with Data Analytics and Visualization
Delivering Security Insights with Data Analytics and VisualizationDelivering Security Insights with Data Analytics and Visualization
Delivering Security Insights with Data Analytics and Visualization
 
Visualization in the Age of Big Data
Visualization in the Age of Big DataVisualization in the Age of Big Data
Visualization in the Age of Big Data
 
Big Data Visualization
Big Data VisualizationBig Data Visualization
Big Data Visualization
 
The Heatmap
 - Why is Security Visualization so Hard?
The Heatmap
 - Why is Security Visualization so Hard?The Heatmap
 - Why is Security Visualization so Hard?
The Heatmap
 - Why is Security Visualization so Hard?
 
Workshop: Big Data Visualization for Security
Workshop: Big Data Visualization for SecurityWorkshop: Big Data Visualization for Security
Workshop: Big Data Visualization for Security
 
Visualization for Security
Visualization for SecurityVisualization for Security
Visualization for Security
 
The Heatmap
 - Why is Security Visualization so Hard?
The Heatmap
 - Why is Security Visualization so Hard?The Heatmap
 - Why is Security Visualization so Hard?
The Heatmap
 - Why is Security Visualization so Hard?
 
DAVIX - Data Analysis and Visualization Linux
DAVIX - Data Analysis and Visualization LinuxDAVIX - Data Analysis and Visualization Linux
DAVIX - Data Analysis and Visualization Linux
 
AfterGlow
AfterGlowAfterGlow
AfterGlow
 
Event Graphs - EUSecWest 2006
Event Graphs - EUSecWest 2006Event Graphs - EUSecWest 2006
Event Graphs - EUSecWest 2006
 
Insider Threat Visualization - HackInTheBox 2007
Insider Threat Visualization - HackInTheBox 2007Insider Threat Visualization - HackInTheBox 2007
Insider Threat Visualization - HackInTheBox 2007
 

Visual Analytics and Security Intelligence

  • 1. Visual Analytics and Security Intelligence Big Data in Action Nordic Security Conference - August 2012 Raffael Marty pixlcloud | creating big data stories copyright (c) 2012
  • 2. Doushuai's Three Barriers ‘You make your way through the darkness of abandoned grasses in a search for meaning. As you do, where is the meaning?' 47th case of'The Gateless Barrier' a collection of Zen koans
  • 3. Raffael Marty 13 years in the log analysis and information visualization space • Founder and CEO @ pixlcloud • Founder and COO @ Loggly • Chief Security Strategist and Product Manager @ Splunk • Manager Solutions @ ArcSight • Intrusion Detection Research @ IBM Research • IT Security Consultant @ PriceWaterhouse Coopers pixlcloud | turning data into actionable insights copyright © 2012
  • 4. Security Intelligence • Where We Wanna Be • SIEM, log management • Changing IT • Did SIEM keep pace? • What’s still missing? • Security Intelligence and Big Data pixlcloud | creating actionable data insights copyright (c) 2012
  • 5. Oblong Industries pixlcloud | creating big data stories copyright (c) 2012
  • 6. http://www.agi.com pixlcloud | creating big data stories copyright (c) 2012
  • 7. Text http://www.agi.com pixlcloud | creating big data stories copyright (c) 2012
  • 8. How do we map this to cyber space? pixlcloud | creating big data stories copyright (c) 2012
  • 9. Security Intelligence Goals ‣ situational awareness ‣ uncover new / previously unknown attacks ‣monitor behavior ‣catch issues before everyone else and before signatures are available ‣ prioritized list of issues / attacks ‣ understand the data that is collected ‣ forensic support (having all the data) ‣ multi sensor fusion (possibly contradicting input) pixlcloud | turning data into actionable insights copyright © 2012
  • 10. Let’s Take Inventory pixlcloud | creating big data stories copyright (c) 2012
  • 11. Log Management and SIEM log management ??? SIEM pixlcloud | creating actionable data insights copyright (c) 2012
  • 12. What’s Working ‣Log management ‣collecting large amount of logs for forensics ‣mandatory data retention ‣Security Information and Event Management ‣Solving specific, known use-cases for sets of known data sources, e.g., ‣ monitoring privileged access to financial servers ‣ generating compliance reports pixlcloud | turning data into actionable insights copyright © 2012
  • 13. What’s Not Working ‣ We use the wrong sources to answer our questions ‣ We don’t understand the data ‣ We don’t have enough context to understand the data ‣ Parsing and normalization is broken ‣ No working way of prioritizing data ‣ SIEMs don’t scale to data volumes ‣ No good way to deal with app-layer data pixlcloud | turning data into actionable insights copyright © 2012
  • 14. How Are We Tracking? ‣ situational awareness ‣ uncover new / previously unknown attacks ‣ prioritized list of issues / attacks ‣ understand the data that is shown ‣ forensic support (having all the data) ‣ multi sensor fusion (possibly contradicting input) pixlcloud | turning data into actionable insights copyright © 2012
  • 15. A New IT Landscape...
  • 16. IT Has Been Changing “memory has become the new hard disk, hard disks are the tapes of years ago” -- unknown source pixlcloud | creating actionable data insights copyright (c) 2012
  • 17. IT Has Been Changing • Cloud - on-demand compute resources - on-demand, limitless storage - on-demand ‘applications’ (MR, DB, ...) • New, free search engines • New data stores and paradigms • New processing capabilities pixlcloud | creating actionable data insights copyright (c) 2012
  • 18. IT has changed security ...
  • 19. Collect it ALL! ‣ Storage has become cheap - we can afford to record more for longer ‣ IT / development has started collecting application data ‣ Compliance has forced us to collect and keep more data ‣ Security can become a profit center! ‣leverage collected data for ‣fraud detection ‣insights into marketing ‣support product analytics, etc. pixlcloud | turning data into actionable insights copyright © 2012
  • 20. SIEMs Are Taking Note • Start to utilize new paradigms (dynamic schema, better scale) • More in the cloud - hands-off • Tracking objects (users, machines) --> building models pixlcloud | creating actionable data insights copyright (c) 2012
  • 21. Has Big Data Helped? ‣ situational awareness ‣ uncover new / previously unknown attacks ‣ prioritized list of issues / attacks ‣ understand the data that is shown ‣ forensic support (having all the data) ‣ multi sensor fusion (possibly contradicting input) pixlcloud | turning data into actionable insights copyright © 2012