![Subject: new commission report breakdown
From: Jose Dave <jose.dave@butercupgames.com>
To: <chris.gilbert@buttercupgames.com>
Content-type: multipart/mixed;
Content-type: application/pdf; name=”Q2_commission.pdf"
dest_ip cmdb_bu_owner cmdb_application_name cmdb_system_owner cmdb_app_lifecycle cmdb_s_ox cmdb_GLBA cmdb_app_uses_ssn
cmdb_credit_card_data cmdb_priority cmdb_server_software cmdb_supported_by cmdb_server_phase cmdb_db_server cmdb_db_name
cmdb_PCI cmdb_PII cmdb_safe_harbor 192.168.56.102 Sales Laptop chris.gilbert@buttercupgames.com Production No No No No Tier 3
Windows7 Internal Deployed N N/A No No No 172.20.12.224 Marketing Laptop monte@demo.com Production No No No No Tier 3
Windows7 Internal Deployed N N/A No No No 172.20.10.217 eCommerce Laptop modesto@demo.com Staging Yes Yes No Yes Tier 1
Windows7 Internal Deployed Y Oracle Yes Yes Yes 172.20.15.229 eCommerce Laptop modesto@demo.com Staging Yes Yes No Yes Tier 1
Windows7 Internal Deployed Y Oracle Yes Yes Yes
27
bad_ip,threat_intel_source
115.29.46.99/32,zeus_c2s
61.155.30.0/24,cymru_http
54.211.114.134 - - [05/May/2014:22:40:54 -0400] "POST /portal/wp-login.php HTTP/1.1" 200 4395 "-”
54.211.114.134 - - [06/May/2014:00:05:47 -0400] "GET /tech/wp-content/uploads/2014/05/Q2_commission.pdf HTTP/1.1" 206 2475168 "-
”
{"action": "create", "path": ”…Content.OutlookQ2_commission.pdf”, "process_guid": “-7751687”}
{"domain": "115.29.46.99", "protocol": 6, "ipv4": "115.29.46.99", "process_guid": “3259531”, "port": 443}
Threat
intelligence
Auth - User
Roles
Host
Activity/Security
Network
Activity/Securit
y
Reconnaissance
Weaponization
Delivery
Exploitation
Installation
Command & Control (C2)
Actions on Objectives](https://image.slidesharecdn.com/splunklive-operationalsecurityintelligencejltoronto-160609195906/75/Operational-Security-Intelligence-27-2048.jpg)
Uploaded bySplunk
Operational Security Intelligence
The document discusses the concept of security intelligence, which involves gathering and analyzing information to protect organizations from various threats. It highlights challenges organizations face, such as insider threats and the need for new security approaches using data science and machine learning for detection and response. The evolution of security operations is emphasized as being collaborative and dynamic, requiring integration of technology, people, and processes.
More Related Content
![Employee Security Training[1]@](https://cdn.slidesharecdn.com/ss_thumbnails/EmployeeSecurityTraining1-122974944243-phpapp01-thumbnail.jpg?width=640&height=640&fit=bounds)
Similar to Operational Security Intelligence
![[Bucharest] Attack is easy, let's talk defence](https://cdn.slidesharecdn.com/ss_thumbnails/attackiseasyletstalkdefencev3-151026104559-lva1-app6891-thumbnail.jpg?width=640&height=640&fit=bounds)
![[cb22] Keynote: Underwhelmed: Making Sense of the Overwhelming Challenge of C...](https://cdn.slidesharecdn.com/ss_thumbnails/cb22keynoteunderwhelmedmakingsenseoftheoverwhelmingchallengeofcybersecurity-230101083039-ff0c756e-thumbnail.jpg?width=640&height=640&fit=bounds)
Operational Security Intelligence
- 1.
- 2. 2 What is SecurityIntelligence? Information relevant to protecting an organization from external and inside threats as well as the processes, policies and tools designed to gather and analyze that information. http://whatis.techtarget.com/definition/security-intelligence-SI
- 3. 3 • Your adversariesare organized • Your adversaries are adaptable • Your defenses are static • Your defenses are predictable • Your defenses will be breached Challenges Source: Mandiant M-Trends Report 2012/2013/2014 100% Valid credentials were used 40 Average # of systems accessed 229 Median # of days before detection 67% Of victims were notified by external entity
- 4. 4 Growing adoption ofcloud, mobile and new application workloads requiring hybrid deployment across on-premise and cloud infrastructures Growing concern of insider threat & privileged users On-going skills/knowledge training 4 More Challenges SOC Director SOC Manager SOC Architect Tier 1 Analyst Tier 2 Analyst Tier 3 Analyst Forensics Specialist Malware Engineer Counter- Intel
- 5.
- 6.
- 7. 7 Solutions and securityapproaches that: – Use threat Intelligence, security services and coordinated defense (sharing) – Rapid response using ad-hoc analysis to handle advanced threats – Utilize data science, machine learning and analytics for security 7 What is Required
- 8. New Approach toSecurity Needed Traditional Methods New Requirements Data reduction Data completeness & coverage Event correlation Multiple, dynamic relationships Detect attacks Detect & respond to attack lifecycle – Disrupt it! Needle in a haystack Hay in haystack Power user All users Severity based Risk-based 8 Event based … and time, user, phase, more…
- 9. New Approach toSecurity Needed Traditional Methods New Requirements 9 Situational awareness Analysis & rapid response Operation / Monitoring Center Nerve Center / Command Center
- 10. Drivers to OperationalizingSecurity Intelligence Detection Early detection and disruption 10 Event driven Analytics driven Correlation Correlation, pattern, anomaly detection Human rule authoring Data science & machine learning Silo’d approach Collaborative and orchestrated
- 11. The Evolution ofSecurity Operations is Needed • Human directed • Goal-oriented • Dynamic (adjust to changes) • Coordinated • Multiple tools & activities • New evasion techniques • Fusion of people, process, & technology • Contextual and behavioral • Rapid learning and response • Share info & collaborate • Analyze all data for relevance • Leverage IOC & Threat Intel THREAT Attack Approach Security Approach 11 TECHNOLOGY PEOPLE PROCESS
- 12. 12 Connect the “Data-Dots”to See the Whole Story Persist, Repeat 1 Deliver, Exploit Install Gain Trusted Access ExfiltrationData GatheringUpgrade (Escalate) Lateral Movement Persist, Repeat Threat Pattern Threat Intelligence Attacker, know C2 sites, infected sites, IOC, attack/campaign intent and attribution • External threat intel • Internal threat intel • Indicators of compromise Network Activity/Security Where they went to, who talked to whom, attack transmitted, abnormal traffic, malware download • Malware sandbox • Web proxy • NetFlow • Firewall • IDS / IPS • Vulnerability scanner Endpoint Activity/Security What process is running (malicious, abnormal, etc.) Process owner, registry mods, attack/malware artifacts, patching level, attack susceptibility • DHCP • DNS • Patch mgmt • Endpoint (AV/IPS/FW) • ETDR • OS logs Authorization – User/Roles Access level, privileged users, likelihood of infection, where they might be in kill chain • Active Directory • LDAP • CMDB • Operating System • Database • VPN, AAA, SSO
- 13. 13 Connecting People andData Through a Nerve Center
- 14. Operationalizing Security Intelligence Risk-BasedContext and Intelligence Connecting People and Data 14
- 15. 15 Machine Generated Datais a Definitive Record of Human-to-Machine and Machine- to-Machine Interaction 1
- 16. 16 Security Relevant Servers Storage DesktopsEmail Web Transaction Records Network Flows DHCP/DNS Hypervisor Custom Apps Physical Access Badges Threat Intelligence Mobile CMDB Intrusion Detection Firewall Data Loss Prevention Anti- Malware Vulnerability Scans Traditional Authentication = Big DataAll Data is
- 17. 17 1 Network EndpointAccess Data Sources Threat Intelligence
- 18. 18 Risk Based Analytics NetworkEndpoint AccessThreat Intelligence Pattern/String/Regex matching Statistical outliers and anomalies Scoring and aggregation Session and Behavior profiling
- 19. 19 Context and Intelligence Integrateacross technologies Automated context matching Automated context acquisition Post processing and post analysis Threat Intelligence Asset & CMDB API/SDK Integrations Data Stores Applications
- 20. 20 Connecting People andData Any data, all data Interact with views and workflows Free form investigation – human intuition Human mediated automation Sharing and collaboration Automation Collaboration Investigation Workflows All data
- 21. Remote Site Headquarters Firewall Database Server File Server Intranet Server Applica on Server Wi-fiFirewall Internet RemoteSite Wi-fiFirewall Wi-fi Information Technology (IT) Monitor Troubleshoot CollaborateTriage ConfigureReport
- 22. Remote Site Headquarters Firewall Database Server File Server Intranet Server Applica on Server Wi-fiFirewall Internet RemoteSite Wi-fiFirewall Wi-fi http (web) session to command & control server Remote control Steal data Persist in company Rent as botnet WEB .pdf .pdf executes & unpacks malware overwritingand running “allowed” programs Svchost.exeCalc.exe Attacker creates malware, embed in .pdf, emails to the target MAIL Read email, open attachment Information Security (InfoSec) Information Technology (IT) Monitor Investigate CollaborateTriage ScopeReport Monitor Troubleshoot CollaborateTriage ConfigureReport Recover
- 23. Remote Site Headquarters Firewall Database Server File Server Intranet Server Applica on Server Wi-fiFirewall Internet RemoteSite Wi-fiFirewall Wi-fi http (web) session to command & control server Remote control Steal data Persist in company Rent as botnet WEB .pdf .pdf executes & unpacks malware overwritingand running “allowed” programs Svchost.exeCalc.exe Attacker creates malware, embed in .pdf, emails to the target MAIL Read email, open attachment Information Security (InfoSec) Information Technology (IT) Monitor Investigate CollaborateTriage ScopeReport Recover Monitor Troubleshoot CollaborateTriage ConfigureReport …
- 24. 24 Threat intelligence Auth -User Roles, Corp Context Host Activity/Security Network Activity/Security Command & ControlExploitation & InstallationDelivery MAIL WEB WEB FW Accomplish Mission Modern Attacks Look Like a Transaction Email Download from infected site 1 2 5 6 7 8 3 4 Identity, Roles, Privileges, Location, Behavior, Risk, Audit scope, Classification, etc.
- 25. 25 Threat intelligence Auth -User Roles, Corp Context Host Activity/Security Network Activity/Security Command & ControlExploitation & InstallationDelivery MAIL WEB WEB FW Accomplish Mission Connect the “Data-dots” to See the Whole Story phishing Download from infected site 1 2 5 6 7 8 3 4 Identity, Roles, Privileges, Location, Behavior, Risk, Audit scope, Classification, etc. Threat Intelligence Data Email Data Or Web Data Host or ETDR Data Web or Firewall Data Threat Intelligence Data Identity Data
- 26. 26 Threat intelligence Auth -User Roles, Corp Context Host Activity/Security Network Activity/Security Command & ControlExploitation & InstallationDelivery MAIL WEB WEB FW Accomplish Mission Start anywhere, analyze up-down-across-backwards-forward phishing Download from infected site 1 2 5 6 7 8 3 4 Identity, Roles, Privileges, Location, Behavior, Risk, Audit scope, Classification, etc. • 3rd party Threat Intel • Open source blacklist • Internal threat intelligence • Firewall • IDS / IPS • Vulnerability scanners • Web Proxy • NetFlow • Network • Endpoint (AV/IPS/FW) • Malware detection • PCLM • DHCP • OS logs • Patching • Active Directory • LDAP • CMDB • Operating System • Database • VPN, AAA, SSO
- 27. Subject: new commissionreport breakdown From: Jose Dave <[email protected]> To: <[email protected]> Content-type: multipart/mixed; Content-type: application/pdf; name=”Q2_commission.pdf" dest_ip cmdb_bu_owner cmdb_application_name cmdb_system_owner cmdb_app_lifecycle cmdb_s_ox cmdb_GLBA cmdb_app_uses_ssn cmdb_credit_card_data cmdb_priority cmdb_server_software cmdb_supported_by cmdb_server_phase cmdb_db_server cmdb_db_name cmdb_PCI cmdb_PII cmdb_safe_harbor 192.168.56.102 Sales Laptop [email protected] Production No No No No Tier 3 Windows7 Internal Deployed N N/A No No No 172.20.12.224 Marketing Laptop [email protected] Production No No No No Tier 3 Windows7 Internal Deployed N N/A No No No 172.20.10.217 eCommerce Laptop [email protected] Staging Yes Yes No Yes Tier 1 Windows7 Internal Deployed Y Oracle Yes Yes Yes 172.20.15.229 eCommerce Laptop [email protected] Staging Yes Yes No Yes Tier 1 Windows7 Internal Deployed Y Oracle Yes Yes Yes 27 bad_ip,threat_intel_source 115.29.46.99/32,zeus_c2s 61.155.30.0/24,cymru_http 54.211.114.134 - - [05/May/2014:22:40:54 -0400] "POST /portal/wp-login.php HTTP/1.1" 200 4395 "-” 54.211.114.134 - - [06/May/2014:00:05:47 -0400] "GET /tech/wp-content/uploads/2014/05/Q2_commission.pdf HTTP/1.1" 206 2475168 "- ” {"action": "create", "path": ”…Content.OutlookQ2_commission.pdf”, "process_guid": “-7751687”} {"domain": "115.29.46.99", "protocol": 6, "ipv4": "115.29.46.99", "process_guid": “3259531”, "port": 443} Threat intelligence Auth - User Roles Host Activity/Security Network Activity/Securit y Reconnaissance Weaponization Delivery Exploitation Installation Command & Control (C2) Actions on Objectives
- 28. Threat intelligence Auth - User Roles Host Activity/Security Network Activity/Securit y 115.29.46.99/32,zeus_c2s 61.155.30.0/24,cymru_http {"domain":"115.29.46.99", "protocol": 6, "ipv4": "115.29.46.99", "process_guid": “3259531”, "port": 443} dest_ip cmdb_bu_owner cmdb_application_name cmdb_system_owner cmdb_app_lifecycle cmdb_s_ox cmdb_GLBA cmdb_app_uses_ssn cmdb_credit_card_data cmdb_priority cmdb_server_software cmdb_supported_by cmdb_server_phase cmdb_db_server cmdb_db_name cmdb_PCI cmdb_PII cmdb_safe_harbor 192.168.56.102 Sales Laptop [email protected] Production No No No No Tier 3 Windows7 Internal Deployed N N/A No No No 172.20.12.224 Marketing Laptop [email protected] Production No No No No Tier 3 Windows7 Internal Deployed N N/A No No No 172.20.10.217 eCommerce Laptop [email protected] Staging Yes Yes No Yes Tier 1 Windows7 Internal Deployed Y Oracle Yes Yes Yes 172.20.15.229 eCommerce Laptop [email protected] Staging Yes Yes No Yes Tier 1 Windows7 Internal Deployed Y Oracle Yes Yes Yes {"action": "create", "path": ”…Content.OutlookQ2_commission.pdf”, "process_guid": “-7751687”} Subject: new commission report breakdown From: Jose Dave <[email protected]> To: <[email protected]> Content-type: multipart/mixed; Content-type: application/pdf; name=”Q2_commission.pdf" 115.29.46.9 9 115.29.46.9 9 Q2_commission.pdf Q2_commission.pdf [email protected] [email protected] "process_guid": “3259531”"process_guid": “-7751687” "action": "create” Reconnaissance Weaponization Delivery Exploitation Installation Command & Control (C2) Actions on Objectives
- 29. Threat intelligence Auth - User Roles Host Activity/Security Network Activity/Securit y 115.29.46.99/32,zeus_c2s 61.155.30.0/24,cymru_http {"domain":"115.29.46.99", "protocol": 6, "ipv4": "115.29.46.99", "process_guid": “3259531”, "port": 443} dest_ip cmdb_bu_owner cmdb_application_name cmdb_system_owner cmdb_app_lifecycle cmdb_s_ox cmdb_GLBA cmdb_app_uses_ssn cmdb_credit_card_data cmdb_priority cmdb_server_software cmdb_supported_by cmdb_server_phase cmdb_db_server cmdb_db_name cmdb_PCI cmdb_PII cmdb_safe_harbor 192.168.56.102 Sales Laptop [email protected] Production No No No No Tier 3 Windows7 Internal Deployed N N/A No No No 172.20.12.224 Marketing Laptop [email protected] Production No No No No Tier 3 Windows7 Internal Deployed N N/A No No No 172.20.10.217 eCommerce Laptop [email protected] Staging Yes Yes No Yes Tier 1 Windows7 Internal Deployed Y Oracle Yes Yes Yes 172.20.15.229 eCommerce Laptop [email protected] Staging Yes Yes No Yes Tier 1 Windows7 Internal Deployed Y Oracle Yes Yes Yes {"action": "create", "path": ”…Content.OutlookQ2_commission.pdf”, "process_guid": “-7751687”} Subject: new commission report breakdown From: Jose Dave <[email protected]> To: <[email protected]> Content-type: multipart/mixed; Content-type: application/pdf; name=”Q2_commission.pdf" 115.29.46.9 9 115.29.46.9 9 Q2_commission.pdf Q2_commission.pdf [email protected] [email protected] "process_guid": “3259531”"process_guid": “-7751687” "action": "create” Tier 1 Analyst Tier 2 Analyst Tier 3 Analyst SOC Mgr Hunters Response Teams Breach Investigator Forensics Counter Threat Team Research/Intelligence Malware research Analytics Security Analyst IT admin/engr Network engr Identity, infrastructure Auditor IT team Network team Security team Monitor Alert Breach Detection & Scoping, CSIRT Share Collaborate Incident response Investigation Contain Remediate Audit, Report, Awareness
- 30.
- 31. 31 Examples 31 Attack Phase What Threat isDoing What to Look For Data Source Lateral movement Creating new admin accounts Account creation without corresponding IT service desk ticket AD/ Service Desk logs Data gathering Stealing credentials For single employee: Login at one location, then logs in again miles away in a timeframe that is not physically possible Badge/ VPN/ Auth Data gathering Gathering confidential data for theft Employee deviates from normal behavior – more requests for confidential data than normal OS Exfiltration Exfiltration of info Larger traffic flows then usual (incl DNS) from a host to a given IP NetFlow
- 32. 32 Insider Threat What ToLook For Data Source Abnormally high number of file transfers to USB or CD/DVD OS Abnormally large amount of data going to personal webmail account or uploaded to external file hosting site Email / web server Unusual physical access attempts (after hours, accessing unauthorized area, etc) Physical badge records / AD Above actions + employee is on an internal watchlist as result of transfer / demotion / poor review / impending layoff HR systems / above User name of terminated employee accessing internal system AD / HR systems
- 33. 33 Example Patterns ofFraud in Machine Data Industry Type of Fraud/Theft/Abuse Pattern Financial Services Account takeover Abnormally high number or dollar amounts of wire transfer withdrawals Healthcare Physician billing Physician billing for drugs outside their expertise area E-Tailing Account takeover Many accounts accessed from one IP Telecoms Calling plan abuse Customer making excessive amount of international calls on an unlimited plan Online Education Student loan fraud Student receiving federal loan has IP in “high-risk” overseas country and is absent from online classrooms and forums
- 34. 34 SECURITY USE CASES In SECURITY& COMPLIANCE REPORTING REAL-TIME MONITORING OF KNOWN THREATS MONITORING OF UNKNOWN, ADVANCED THREATS INCIDENT INVESTIGATIONS & FORENSICS INSIDER THREAT 3 Splunk Can Complement OR Replace an Existing SIEM INSIDER THREAT
- 35. 35 SPLUNK FOR SECURITY 3 SECURITYAPPS & ADD-ONS SPLUNK APP FOR PCI SIEM Security Analytics Fraud, Theft and Abuse Platform for Security Services SPLUNK USER BEHAVIOR ANALYTICS Wire data Windows = SIEM integration RDBMS (any) data SPLUNK ENTERPRISE SECURITY
- 36. 36 SPLUNK IS THENERVE CENTER 36 App Endpoint/ Server Cloud Threat Intelligence Firewall Web Proxy Internal Network Security Identity Network
- 37. 37 Getting Started Splunk Enterprise Free Download Enterprise SecurityCloud Trial Splunk UBA Proof of Value
- 38. 38 SEPT 26-29, 2016 WALTDISNEY WORLD, ORLANDO SWAN AND DOLPHIN RESORTS • 5000+ IT & Business Professionals • 3 days of technical content • 165+ sessions • 80+ Customer Speakers • 35+ Apps in Splunk Apps Showcase • 75+ Technology Partners • 1:1 networking: Ask The Experts and Security Experts, Birds of a Feather and Chalk Talks • NEW hands-on labs! • Expanded show floor, Dashboards Control Room & Clinic, and MORE! The 7th Annual Splunk Worldwide Users’ Conference PLUS Splunk University • Three days: Sept 24-26, 2016 • Get Splunk Certified for FREE! • Get CPE credits for CISSP, CAP, SSCP • Save thousands on Splunk education!
- 39.
Editor's Notes
- #3 Activities and artifacts that enable you to make informed decisions so you can detect, respond and more effectively resolve issues from anywhere in the attack lifecycle/kill chain
- #4 Which mean you are always on your heels reacting and trying plugging holes …
- #7 As well as learning a myriad of options and solutions …
- #9 Using a set of conditions UBA – data science – identify and relate anomalies and threats as well as ties them to entities (users/systems/devices) involved
- #10 Automate
- #12 Indicators Of Compromise
- #13 “malware sandbox” – FireEye , Palo Alto Network’s Wildfire technology detonate email and web-based payloads and attachments and links in a virtual sandbox “payload analysis” or “advanced malware detection”. ETDR is Endpoint Threat Detection and Response, Cyvera (now part of Palo Alto Networks), Carbon Black (part of Bit9), RSA ECAT
- #15 The process of discovering relationships across all security-relevant data, including data from IT infrastructures, point security products and all machine-generated data to rapidly adapt to a changing threat landscape.
- #21 Lock an account after 10 failed logins but if it an executive account someone has to authorize/approve it.
- #25 The following is a very simplistic description of an attack sequence. The modern attacks look a lot like a transaction, meaning: There are multiple steps There is an objective/goal/mission Each step could be different Different technology components see different aspects of the “transaction” An attack sequence looks like the following: The attacker infects a site (which contains the malware) or creates malware that is embedded in an executable file (like a .pdf – which is capable of running java script) The attacker sends an email with the malware embedded in the file or the attacker sends an email with a link to the site that is infected or the victim visits the infected site (from a search or other means) The malware is on the “victim” machine (delivered by email or downloaded by the user) notice the malware can be downloaded but not executed The malware is then executed (it was hidden in the email attachment or it was hidden web page of the infected site) The malware creates processes, installs itself and performs a variety of task/operations/processes on the “victim” – often trying to hide itself The malware calls back to the attacker to get additional software and direction, typically using allowed outbound traffic like web or other allowed services through the firewall The attacker gains control of the “victim” machine and uses it’s “trusted access (the valid credentials)” to look for other machines to attack, The attacker uses the first victim as a gateway to access other systems, often creating additional user IDs, credentials, mapping the network to determine what is in the network and ultimately to accomplish the mission. At this stage, the attacker has gained persistence in the environment. Several things to notice: The sequence of events looks very similar to an ecommerce transaction or any other event chain across multiple devices and technologies Any step in the “event chain” has relationships from one event to the next Any activity along the event chain can be different from one attack to another The goal of any security program is to detect, prevent, respond and recover from attacks whether from the outside or from the inside.
- #26 Endpoint Threat Detection and Response
- #27 Where they went to, who talked to who, was an attack/payload transmitted, nay abnormal traffic, was malware downloaded What process is running (malicious, abnormal, etc.) Process owner, registry mods, attack/malware artifacts, patching level, attack susceptibility Access level, privileged users, likelihood of infection, where they might be in kill chain
- #29 Identify a threat intelligence hit
- #33 Insider threat is the current or former employee, contractor, or partner organization with malicious intent.
- #34 Ultimately the patterns of fraud often are in machine data and searches can be written to look for these patterns and then alert on them.