Operationalizing Big Data Security Analytics - IANS Forum Dallas

1 | © 2018 Interset Software
How to
Operationalize
Big Data Security
Analytics
Stephan Jou
Chief Technology Officer
Interset.AI

Hey. I’m Stephan Jou. I like analytics.
 CTO at Interset
 Previously: Cognos and IBM’s Business
Analytics CTO Office
 Big data analytics, visualization, cloud,
predictive analytics, data mining, neural
networks, mobile, dash-boarding and
semantic search
 M.Sc. in Computational Neuroscience and
Biomedical Engineering, and a dual B.Sc. in
Computer Science and Human Physiology, all
from the University of Toronto

About Interset.AI
SECURITY ANALYTICS LEADER PARTNERSABOUT US
Data science & analytics
focused on cybersecurity
100 person-years of security
analytics and anomaly
detection R&D
Offices in Ottawa, Canada;
Newport Beach, CA
Interset.AI

What is AI-Based Security Analytics About?
Advanced analytics to help you catch the bad guys

Bringing Together a Fragmented Landscape
Fragmented security landscape Integrated view of security data

zz
Increasing Threat Hunting Efficiency
Low Success Rate SOC Cycle Generate Highly Anomalous Threat Leads

Increasing Visibility by Augmenting Existing Tools
SECURITY ANALYTICS
SIEM
IAMENDPOINT
BUSINESS
APPLICATIONS
CUSTOM
DATA
NETWORK DLP
SIEM
IAMENDPOINT NETWORK DLP

Case Study #1: $20B Manufacturer

z
Lesson #1: The Math Matters – Test It
 Too much snake oil
 The math matters – but the
use case matters more
 Don’t rely on a smoking gun
Recommendations
• Agree on the use cases in advance
• Use a proof-of-concept with historical/existing data to test the SA’s math
• Engage red team or pen testing if available
• Evaluate the results: Do they support the use cases?

Case Study #2: Every Interset Customer
Billions of events
analyzed with
machine learning
Anomalies
discovered by
data science
High quality
“most wanted”
list
Analyzes the intersection of data from users, machines, files, projects,
servers, sharing behavior, resource, websites, IP Addresses and more
5,210,465,083

z
Lesson #2: Less Alerts, Not More
 Solution should help you deal
with less alerts, not more alerts
 Solution should leverage sound
statistical methods to reduce
false positives and noise
 Should allow you to do more
with the limited resources you
have
Recommendations
Measure and quantify the amount of work effort involved with and without the
Security Analytics system

Case Study #3: Defense Contractor
zz
High Probability Anomalous Behavior Models
 Detected large copies to the portable hard drive,
at an unusual time of day
 Bayesian models to measure and detect highly
improbable events
High Risk File Models
 Detected high risk files, including PowerPoints
collecting large amounts of inappropriate content
 Risk aggregation based on suspicious behaviors
and unusual derivative movement

Lesson #3: Automated, Measured Responses
 Security Analytics system should
allow you to quantify risk, not just a
binary alert
 Consider how to automate responses
to low, medium, high and extreme risk
scenarios
 Where does security analytics fit into
your existing runbook?
Recommendations
• Ensure the Security Analytics system has the ability to output a risk assessment level
or score, not just a binary alert
• Ensure the Security Analytics system can integrate with downstream systems
• Evaluate the solution with automated response systems as part of the deployment

Case Study #4: Healthcare Records & Payments
 Profile: 6.5 billion transactions annually, 750+
customers, 500+ employees
 Team of 7: CISO, 1 security architect, 3 security
analysts, 2 network security
 Analytics surfaced (for example) an employee who
attempted to move “sensitive data” from endpoint to
personal Dropbox
 Employee was arrested and prosecuted using
incident data
Focus and prioritized incident responses
Incident alert accuracy increased from 28% to 92%
Incident mitigation coverage doubled from 70 per week to 140

Lesson #4: Meaningful Metrics
Hawthorne Effect: Whatever gets measured,
gets optimized
Recommendations
 Define meaningful operational metrics (not just
“false positives”)
 Build a process for measuring and quantifying over
time, not just during a pilot
 Ensure the Security Analytics system supports a
feedback process to adjust the analytics to support
your target metrics

What Have We Learned?
Lessons Learned
 The Math Matters – Test It
 Less Alerts, Not More
 Automated, Measured Responses
 Meaningful Metrics
Recommendations
 Agree on the use cases in advance
 Evaluate results with and without security
analytics system
 Assess risk level, not binary alert
 Ensure integrated feedback and
automated response

More Case Studies
Digital Advertising Agency
Prove not cause of Star Wars leak
“Interset’s unique ability to analyze billions
of events and distill them into high-
confidence security intelligence allows us to
quickly separate threats from the noise.
This visibility and focus allows our security
practitioners to quickly investigate and
remediate threats even as they become
increasingly pervasive and sophisticated.”
MSSP
“SOC in Box”
“By embedding Interset’s security analytics
into our Prescriptive Security managed
service, we provide our customers with very
rapid reaction to threats and improved
Security Operations Center efficiency.” -
Stephen Shibel, head of Big Data &
Cybersecurity for Atos North American
Operations

QUESTIONS?
Stephan Jou, CTO
@eeksock
Learn more at Interset.AI

Operationalizing Big Data Security Analytics - IANS Forum Dallas

More Related Content

What's hot

Similar to Operationalizing Big Data Security Analytics - IANS Forum Dallas

Recently uploaded

Operationalizing Big Data Security Analytics - IANS Forum Dallas