Building a Security Information and Event Management platform at Travis Perkins
1 like•2,206 views
The document discusses the implementation of a Security Information and Event Management (SIEM) platform at Travis Perkins, led by Nick Bleech, focusing on challenges in integrating on-premise and cloud services, as well as operational intelligence. Key success factors for the SIEM include incremental planning, establishing clear roles within security operations, and effective alerting processes, while also highlighting the importance of a risk-based approach to incident response. The presentation outlines the benefits obtained through the use of Splunk Cloud, including improved data ingestion and correlation, alongside future roadmap considerations.
Building a Security Information and Event Management platform at Travis Perkins
- 1. Copyright © 2016 Splunk Inc. @SplunkUK Building a Security Information and Event Management Platform at Travis Perkins Nick Bleech Head of Information Security Travis Perkins Matthias Maier Security Product Marketing Manager Splunk
- 2. Q&A at the end Please use the Q&A panel window
- 3. 3 At Splunk we have the best, most successful and passionate customers with incredible stories to share. These include how our customers ...
- 11. 11 Make machine data accessible, usable and valuable to everyone. 11
- 12. Platform for Machine Data Applicatio n Delivery Security, Compliance and Fraud Business Analytics Industrial Data and Internet of Things IT Operations Mainframe Data Relational Databases MobileForwarders Syslog/TCP IoT Devices Network Wire Data Hadoop The Use Cases for Operational Intelligence
- 13. 13 Splunk Cloud Available Worldwide
- 15. Speaker - Nick Bleech • I’m currently CISO for the Travis Perkins Group. • The UK's largest Building Materials Group. • I started in IT Security technology R&D in 1985. • Moved on to security management and architect roles in Aerospace, Government, Financial Services & Consulting. • Before Travis Perkins I was the CISO at Rolls-Royce plc. – Served on the board of the Jericho Forum – Expert group which established core principles for ‘Cloud’ Security
- 16. 16 What We Do • My team at Travis Perkins tackles practical challenges including: • Security Monitoring • Incident Response • Driving the governance to tackle Cloud Computing • Data Security • Internet of Things • Agile Development practices • Information System Lifecycle security risks
- 17. 17 Agenda • Introduction • Beginning – SIEM ‘mark one’ • CSFs for SIEM ‘mark two’ • CSFs for ‘Lean’ SOC • Operating Model • Monitoring Architecture • Productionization • Benefits we’ve realized and future roadmap
- 18. 18 Travis Perkins Challenges • Complex IT, mix of on-premise legacy systems/services and the cloud services progressively replacing them • ‘Cloud First’ i.e. all new solutions must deploy into Cloud and interwork with on-premise as needed • This meant rolling Splunk out in the Cloud then extending back to on-premise rather than the other way round (although pilot was on-premise)
- 19. 19 Travis Perkins Challenges • Need to be able to adapt data source interfaces at low cost / complexity using open source • Many parallel IT change / new build projects in flight - e- com, ERP, supply chain etc. • SIEM Business drivers balanced between Incidents, Investigations, and Compliance use-cases - need flexible and adaptable technology • No pre-existing internal or external ‘SOC’, no preference to engage a Managed Security Services Provider due to velocity of change and aim to grow in-house expertise
- 20. 20 The Beginning • The ‘Big Bang’: • Acquire SIEM hardware & software – one size fits all - ($$$$$) • Connect as many sources as possible (Look Ma - all those connectors!) • No data source is too large or too complex • When budget/time/resources run out: SIEM ‘mark one’ that was tagged ‘never again’ Oh dear...stop!
- 21. 21 The Beginning • Must show early cost/benefit to retain stakeholder buy-in • Need service integration architecture - not just SIEM infrastructure • No long term strategy initiated/developed • SIEM projects very similar to Data Warehouse & Business Intelligence app projects • This experience gave other security improvement projects a bad name! Lessons learnt – the hard way Worst of all… CISO was replaced!
- 22. 22 Critical Success factors for SIEM ‘mark two’ ● Plan/Deliver incrementally - no ‘big bang’ ● Grow ‘Lean’ SOC: Develop clear roles for IT Ops Service Ops vs. Infosec forensics ● Design Op team alerting carefully for maximum effectiveness ● Monitoring architecture to include both ‘agent-based’ & ‘agentless’ data collection ● Acknowledge and meet multiple stakeholder needs SIEMIT New Build IT Ops CIO EA Legal/Compl iance Infosec
- 23. 23 Critical Success Factors for ‘Lean’ SOC Plan/Deliver incrementally: • Roll out the most effective handling/response process to cover most likely scenario • Train teams on new process, tune data source and Splunk correlation searches • ‘Rinse - Wash - Repeat’
- 24. 24 Critical Success Factors for ‘Lean’ SOC Develop clear roles for IT Ops Service Ops vs. Infosec forensics teams: • IT Ops catch, gather info, dispatch for further investigation/remediation • Infosec forensics have specialist skills including Splunk training • Enable follow up detailed investigation post initial response
- 25. 25 Critical Success Factors for ‘Lean’ SOC Design Op team alerting carefully for maximum effectiveness without detailed knowledge of Splunk or other tools • Use Splunk/ES risk scoring appropriately • An alert can be like a finger on a spray can: a little alert can trigger a lot of response if you put the right stuff in the can....
- 26. 26 Operating Model Canned alerts are 80% effective in the first instance, and always provide value by gathering some additional information
- 27. 27 Last 30 days of ‘Ransomware’ attacks tracking. Splunk detected 135 low-level events it correlated as ‘high risk’ in the period
- 28. 28 Splunk Response Process Risk score triggers alert for target OPs team responds, gathers info, claims notable events & updates them with info OPs team creates incidents for automated in- depth malware scans an/or automated forensics, updates events OPs team submits any binary samples from target to enterprise AV vendor, requests AC scan & cleanup Infosec confirm using Splunk & data collected by Ops that target is clean. If target is not clean, IS can request rebuild or access to target for more forensics Notes 1. Integration with ServiceNow is planned 2. Process is Pareto-inspired: 80% of events can be handled by this process, on 80% of the infrastructure (Windows, server/client) and resolved at least 80% effective in the first instance 3. For events which OPs cannot resolve (no skills, no access) they can always add value by collecting information about the target
- 29. 29
- 30. 30 Risk score triggers alert for target OPs team responds, gathers info, claims notable events & updates them with info OPs team creates incidents for automated in- depth malware scans an/or automated forensics, updates events OPs team submits any binary samples from target to enterprise AV vendor, requests AC scan & cleanup Infosec confirm using Splunk & data collected by Ops that target is clean. If target is not clean, IS can request rebuild or access to target for more forensics Notes 1. Integration with ServiceNow is planned 2. Process is Pareto-inspired: 80% of events can be handled by this process, on 80% of the infrastructure (Windows, server/client) and resolved at least 80% effective in the first instance 3. For events which OPs cannot resolve (no skills, no access) they can always add value by collecting information about the target Splunk Response Process
- 31. 31
- 32. 32 Risk score triggers alert for target OPs team responds, gathers info, claims notable events & updates them with info OPs team creates incidents for automated in- depth malware scans an/or automated forensics, updates events OPs team submits any binary samples from target to enterprise AV vendor, requests AC scan & cleanup Infosec confirm using Splunk & data collected by Ops that target is clean. If target is not clean, IS can request rebuild or access to target for more forensics Notes 1. Integration with ServiceNow is planned 2. Process is Pareto-inspired: 80% of events can be handled by this process, on 80% of the infrastructure (Windows, server/client) and resolved at least 80% effective in the first instance 3. For events which OPs cannot resolve (no skills, no access) they can always add value by collecting information about the target Splunk Response Process
- 33. 33 Risk score triggers alert for target OPs team responds, gathers info, claims notable events & updates them with info OPs team creates incidents for automated in- depth malware scans an/or automated forensics, updates events OPs team submits any binary samples from target to enterprise AV vendor, requests AC scan & cleanup Infosec confirm using Splunk & data collected by Ops that target is clean. If target is not clean, IS can request rebuild or access to target for more forensics Notes 1. Integration with ServiceNow is planned 2. Process is Pareto-inspired: 80% of events can be handled by this process, on 80% of the infrastructure (Windows, server/client) and resolved at least 80% effective in the first instance 3. For events which OPs cannot resolve (no skills, no access) they can always add value by collecting information about the target Splunk Response Process
- 34. 34
- 35. 35 Risk score triggers alert for target OPs team responds, gathers info, claims notable events & updates them with info OPs team creates incidents for automated in- depth malware scans an/or automated forensics, updates events OPs team submits any binary samples from target to enterprise AV vendor, requests AC scan & cleanup Infosec confirm using Splunk & data collected by Ops that target is clean. If target is not clean, IS can request rebuild or access to target for more forensics Notes 1. Integration with ServiceNow is planned 2. Process is Pareto-inspired: 80% of events can be handled by this process, on 80% of the infrastructure (Windows, server/client) and resolved at least 80% effective in the first instance 3. For events which OPs cannot resolve (no skills, no access) they can always add value by collecting information about the target Splunk Response Process
- 37. 37 Monitoring Architecture (1) • Allow for both ‘agent-based’ & ‘agentless’ data collection to trade off: – Performance, data volumes, server/network impacts and ‘IT politics’! • Standard Splunk data source integration methods: – Cloud / “as a service” products e.g. ServiceNow and FireEye ETP publish APIs, which can be accessed using Splunk apps or Splunk RESTful API data source configurator – Excellent AWS app enables both collection of AWS native log data (AWS Auth etc) and ingestion / indexing of application data from AWS S3 buckets – Standard Splunk Forwarder sends on prem data to Splunk Cloud
- 38. 38 Monitoring Architecture (2) • Open source data integration: Highly scalable and performant, OSQuery for host based IDS and FIM (PCI compliant) across whole AWS estate – No central server required (as would be the case for OSSEC) – Easy to deploy in ‘continuous integration’ automated pipelines • Although OSQuery output not Splunk Common Information Model compliant, Splunk immediately understands its json format data • Enables meaningful correlation searches to be written once data is indexed • We are free to choose where we parse out meaningful source data for each use case - in OSQ or in Splunk - or both
- 39. 39 Productionisation ● We ran an on prem pilot / proof of value using “found” hardware ● Bore an uncanny resemblance to hardware from our previous SIEM… ● We got a working solution, but speed, storage, and reliability issues arose ● Analysts not good SysAdmins - so get better not minding infrastructure ● Per our Cloud First strategy, we considered two options: ● host within our own AWS VPCs, or ● purchase the Splunk Cloud SaaS ● In terms of cost/benefit, Splunk Cloud option came out ahead ● Migration took 2 days to get basic functionality up and running
- 40. 40 Benefits Obtained and Future Roadmap ● Quicker from ingesting new data to creating meaningful correlation searches ● We were used to having console access to edit .conf files on-prem; but fewer concerns now Splunk Cloud increasing functionality in the GUI ● Splunk CloudOps are taking pain out of managing host infrastructure ● Intrinsic risk-score based correlation in Slunk/ES has been pivotal in several security incidents ● Our architecture and approach now serve as blueprint for IT Ops and App support teams to leverage Splunk for non-security event/log monitoring
- 41. Sophos Security in the cloud, UK, Splunk powers their SOC Security analytics driven SOC to protect the business Splunk Cloud delivered from within EU as SaaS Splunk for real-time reporting, alerting & investigation How Sophos Uses Splunk Cloud For An Analytics Driven SOC
- 42. 42 How Gatwick Airport Ensures Better Passenger Experience With Splunk Cloud On-time efficiency & dramatic queue reduction with 925 flights per day Real-time, predictive airfield analytics deliver on mobile app & Apple watch Data from airport gates, board pass scans, x-ray, travel, passenger flow
- 43. Security Operations IT Operations Business Operations With Splunk, your enterprise data platform SAME DATAOf the Asking Different QUESTIONS Different PEOPLE
- 44. Next Step: Discovery Workshop What’s your Security Use Case? • Cost justification for your management • Success measurement • Prioritization • Scoping of data sources / data volume / costs • Establishing organizational processes • Data privacy justification 15
- 45. Explore: The Art of the Possible http://splk.it/artofpossible Join: Our Community with Apps, Ask Questions or join a SplunkLive! event https://www.splunk.com/en_us/community.html Try: Splunk Enterprise Security in our Sandbox with 50+ Data Sources https://www.splunk.com/getsplunk/es_sandbox Q&A Please complete the survey Thank you