Downloaded 159 times
![© 2015 MapR Technologies 8
The Problem Requires Better Data and Better Tools (cont’d)
• Persistent threats and their complexity is expanding rapidly
– Criminal organizations are creating new and better attacks
• [Gameover] Zeus (Botnet and data theft)
• Crypto-Locker/Wall, CTB-Locker (data theft)
• Dexter, POSLogr, BlackPOS (Point of Sale Terminal malware)
– The Nations states show criminals virtually anything is possible
• StuxNet malware (Supervisory Control and Data Acquisition (SCADA)
malware)
• Direct Memory Access Video RAM malware
• TAO- Micro processor embedded malware (network sniffing, key logging,
data collection, remote access, etc.)
• “nls_933w.dll”- Hard drive Firmware embedded malware (anything)](https://image.slidesharecdn.com/securityanalyticsandbigdata-whatyouneedtoknow-150427105842-conversion-gate02/75/Security-Analytics-and-Big-Data-What-You-Need-to-Know-8-2048.jpg)
Uploaded byMapR Technologies
Security Analytics and Big Data: What You Need to Know
The document discusses a webinar on security analytics and the importance of integrating big data solutions, particularly the use of Hadoop technologies, to improve threat detection and response capabilities in cybersecurity. It highlights challenges organizations face, including high data volumes and inadequate tools for managing and analyzing security data, and emphasizes the benefits of using advanced analytics for better threat identification and reduced false positives. Case studies featuring Zions Bank and Solutionary demonstrate the effectiveness of MapR's solutions in enhancing security operations and analytics.
More Related Content
![Innovation in Cybersecurity [Montreal 2018 CRIAQ RDV Forum]](https://cdn.slidesharecdn.com/ss_thumbnails/interset-innovatingincybersecurity-180423194815-thumbnail.jpg?width=640&height=640&fit=bounds)
![IANS Forum Charlotte: Operationalizing Big Data Security [Tech Spotlight]](https://cdn.slidesharecdn.com/ss_thumbnails/ianstechnologysessionscharlottemh0918181-181001215101-thumbnail.jpg?width=640&height=640&fit=bounds)
Similar to Security Analytics and Big Data: What You Need to Know
More from MapR Technologies
Security Analytics and Big Data: What You Need to Know
- 1. David Monahan Research Director EMA SecurityAnalytics and Big Data: What You Need to Know Sameer Nori Senior Product Marketing Manager MapR Nick Amato Director Technical Marketing MapR
- 2. © 2015 MapRTechnologies 2 Today’s Presenters David Monahan, Research Director, Risk & Security Management, EMA David has over 15 years of IT security experience and has organized and managed both physical and information security programs, including Security and Network Operations (SOCs and NOCs) for organizations ranging from Fortune 100 companies to local government and small public and private companies. Sameer Nori, Senior Product Marketing Manager, MapR Technologies Sameer has over ten years of experience in the technology industry in marketing, pre-sales, and consulting, with domain experience in business intelligence, analytics, and big data. Nick Amato, Director, Technical Marketing, MapR Technologies Nick works with the MapR ecosystem and technology partners to identify new opportunities where the MapR platform can bring value to customers. His areas of focus include third-party integrations with BI tools, benchmarking, architecture, and enabling scalable data platforms.
- 3. © 2015 MapRTechnologies 3 Logistics for Today’s Webinar A PDF of the PowerPoint presentation will be available An archived version of the event recording will be available at www.enterprisemanagement.com • Log questions in the Q&A panel located on the lower right corner of your screen • Questions will be addressed during the Q&A session of the event Questions Event recording Event presentation
- 4. David Monahan Research Director,Security and Risk Management Enterprise Management Associates http://www.enterprisemanagement.com @SecurityMonahan The Convergence of Security Analytics and Big Data April 27, 2015
- 5. © 2015 MapRTechnologies 5 Threats Come From Everywhere • Hacking: The mentality has changed • Data breaches affect every industry • Organizations are being attacked from all sides – External threats – Insider threats • All information is up for grabs
- 6. © 2015 MapRTechnologies 6 Identifying Threats is Harder Than Ever EMA research identified several troubling statistics about identifying and responding to threats: of organizations were between “Highly Doubtful” and only “Somewhat Confident” that they could detect an important security issue before it had a significant impact. of organizations believe they are consistently successful in in correlating security data to business impact. of organizations said they were unable to stop exploits because of outdated or insufficient threat intelligence. 69% 22% 60% 41% 28% 33% 29% TOO DIFFICULT SEPARATING LEGITIMATE FROM MALICIOUS ACTIVITY TOO DIFFICULT PRIORITIZING REMEDIATION ACTIVITIES INABILITY TO REPORT MEANINGFUL INFORMATION TO STAKEHOLDERS INSUFFICIENT TOOLING TO SUPPORT SECURITY DUTIES Top frustrations with IT Security Practices:
- 7. © 2015 MapRTechnologies 7 The Problem Requires Better Data and Better Tools • Data volumes are too high – EMA research identified that 45% of organizations are collecting more than 40GB/day of logs – Nearly 16% are collecting over 500GB/day of logs • Data correlation and normalization is not sufficient – Organizations are fielding 100:1 high priority and greater alerts per person in security • Operations, Analysts, and Responders need better context and Higher Fidelity (Ponemon Study) – Actionable Intelligence within 60 seconds reduced breach resolution costs by an average of 40%
- 8. © 2015 MapRTechnologies 8 The Problem Requires Better Data and Better Tools (cont’d) • Persistent threats and their complexity is expanding rapidly – Criminal organizations are creating new and better attacks • [Gameover] Zeus (Botnet and data theft) • Crypto-Locker/Wall, CTB-Locker (data theft) • Dexter, POSLogr, BlackPOS (Point of Sale Terminal malware) – The Nations states show criminals virtually anything is possible • StuxNet malware (Supervisory Control and Data Acquisition (SCADA) malware) • Direct Memory Access Video RAM malware • TAO- Micro processor embedded malware (network sniffing, key logging, data collection, remote access, etc.) • “nls_933w.dll”- Hard drive Firmware embedded malware (anything)
- 9. © 2015 MapRTechnologies 9 The Problem Requires Better Data and Better Tools (cont’d) • EMA Research has identified key issues with current tools Most Significant Frustrations with IT Security Technologies 38% 36% 35% LACK OF INTEGRATION/INTEROPERABILITY TOOLS UNABLE TO RECOGNIZE EMERGING THREATS/ATTACKS VENDORS ARE SLOW TO RESPOND TO EMERGING THREATS OR ATTACKS
- 10. © 2015 MapRTechnologies 10 SIEM Limitations SIEM technology provides real-time analysis of security alerts generated by network hardware and applications. This is limited “analysis” based primarily upon correlation and normalization of alerts. SIEM only understands deltas for those things inside of its defined rules or policies SIEM understands network information and log entries to correlate events at a network level and identify system/application alerts. SIEM does not understand human, system, and application specific activity and patterns (behaviors) to determine how some activities raise the threat level. Post notification SIEM often requires manual investigation*. * EMA research found 55% of organizations said they still conduct manual incident investigations
- 11. © 2015 MapRTechnologies 11 SIEM Limitations(cont’d) What features is your organization not getting from SIEM tools that it is looking for in Security Analytics technology/products? 65% 53% 51% ADVANCED AUTOMATED RESPONSE CAPABILITIES INCREASED ABILITY TO EASILY AGGREGATE AND CROSS ANALYZE DATA FROM NON-SECURITY SOURCES (IE NETFLOW, WEB ACCESS LOGS) ENHANCED DATA VISUALIZATION
- 12. © 2015 MapRTechnologies 12 Poll Question #1 Have you heard of Security Analytics or Security Intelligence as a solution? A. Have not heard of it B. Believe they are the same as SIEM C. Deployed a security analytics solution D. Considering security analytics in the next 6-12 months
- 13. © 2015 MapRTechnologies 13 Moving to Security Analytics Security Analytics Improvements Better context and fidelity Reduce false positives Reduce alert volumes Provide better prioritization Accelerate Incident Response of organizations using Security Analytics have seen a reduction in false positives or an improvement in actionable alerts since they implemented a Security Analytics technology. of organizations that use Security Analytics said that the tool produced expected or greater than expected value. 90% 95%
- 14. © 2015 MapRTechnologies 14 Why Security Analytics Which of the following are your organization’s views or reasons why it needs/uses capabilities for advanced analytics or security data management for IT/information security? 53% 46% 43% 36% IMPROVES DEFENSE AGAINST TARGETED THREATS INCREASES OPERATIONAL EFFICIENCIES DEMONSTRATING HIGHER SECURITY EFFECTIVENESS TO THE BUSINESS IMPROVES PRODUCTIVITY/EFFICIENCY OF IT SECURITY EFFORTS IMPROVES STRATEGIC DECISION MAKING
- 15. © 2015 MapRTechnologies 15 Why Hadoop for Security Analytics • We need tools that can handle more data and a wider variety of data. – When asked if they would collect more data or a wider variety of data if they could, 66% of organizations said they would. (Only 10% said they would not.) – EMA Research - 57% of organizations said that they expect the greatest improvements in security through data analysis to come from innovations from IT security technologies and their vendors. – For true fidelity we need to be able to combine ALL information relevant to data management. • User, system, application, network packet/netflow, infrastructure logging, HR records, endpoint, et. al. • EMA Research - 32% of organizations indicated they wanted to be able to analyze unstructured data for use in security.
- 16. © 2015 MapRTechnologies 16 Benefits of Hadoop for Security Analytics • Purpose-built for processing large amounts of data • Designed for unstructured data analysis • Business Analytics can be applied to security use cases • Increased ROI from a tool that supports both Business Intelligence and Security Operations 47% 36% 35% 35% MACHINE LEARNING TOOLS FRAUD MANAGEMENT OR DETECTION SYSTEM BUSINESS INTELLIGENCE (BI) PLATFORM ENTERPRISE DATA WAREHOUSES Which of the following non-traditional data sources are currently NOT included/supported by your organizations current SIEM or log management system?
- 17. © 2015 MapRTechnologies 17© 2015 MapR Technologies Security Log Analytics on MapR
- 18. © 2015 MapRTechnologies 18 Zions Bank: Security Analytics and Fraud Detection Cost effective security analytics and fraud detection on one platform • Fraud Operations and Security Analytics team at Zions maintains data stores, builds statistical models to detect fraud, and then uses these models to data mine and evaluate suspicious activity “We initially got into centralizing all of our data from an information security perspective. We then saw that we could use this same environment to help with fraud detection” Michael Fowkes - SVP Fraud Operations and Security Analytics • Existing technology infrastructure could not scale • Timeliness of reports degraded over the last several years • Chose MapR and cut storage costs by 50% • Querying time reduced from 24 hours to 30 min on 1.2 PB of data • Leverage MapR scale for increased model accuracy and deeper insights OBJECTIVES CHALLENGES SOLUTION Business Impact
- 19. © 2015 MapRTechnologies 19 Zions Bank with MapR – Faster Operations at Lower Costs Web Server Data Transactional Data 3rd Party Real Time Fraud Detection Reporting and Batch Analytics Deeper Analysis with Machine Learning PRD and Dev on MapR N F S Technical Benefits High availability Multi-tenancy Snapshots Performance Business Benefits Unified platform for data Lower operating costs Operational guarantees Faster model development
- 20. © 2015 MapRTechnologies 20 Solutionary: Managed Security Services Provider Threat detection on real-time streaming data via platform as a service • To address their growing customer base by processing trillions of messages (petabyte) per year while continuing to provide reliable security services • To improve data analytics by leveraging newer, more granular unstructured data sources ”MapR has taken Apache Hadoop to a new level of performance and manageability. It integrates into our systems seamlessly to help us boost the speed and capacity of data analytics for our clients.” - Dave Caplinger, Director of Architecture, Solutionary • Expanding existing database solution to meet demand was cost prohibitive • The existing technology could not process unstructured data at scale • Replaced RDBMS with MapR Enterprise Database Edition to scale Reduced time needed to investigate security events for relevance and impact • Improved data analytics, enabling new services and security analytics • 2x faster performance compared to competing solutions OBJECTIVES CHALLENGES SOLUTION Business Impact Leader in Magic Quadrant
- 21. © 2015 MapRTechnologies 21 Why MapR for Security Analytics Business • Large scale and deep analytics on security data to reduce risk • Early detection of advanced persistent threats and unknown threats • React fast on any abnormal or malicious activity from internal and external actors • Avoid fines, lawsuits, loss of business and negative PR Technical • Build a data vault for security event logs from multiple sources • With more data to scrutinize, get insights into anomalous behavior and close loop with other security solutions • Platform that enables analysis of both historical data as well as real-time analysis of large volumes of security data Operations • Fast ingestion of large volume of data and perform deep analytics • Easy integration with existing IT ecosystem • Low overhead to maintain system • Early detection of threats and closed loop feedback with existing security solutions
- 22. © 2015 MapRTechnologies 22 The MapR Advantage • Scale Reliability Across the Enterprise – Advanced multi-tenancy – Business continuity – HA, DR • Speed – 2-7x faster than other Hadoop distributions – Ultra-fast data ingest (100M data points per sec) – NFS & R/W file system • Real-time & Self-Service Data Exploration – On-the-fly SQL without up-front schema – Fast lookups and queries Best Hadoop Platform for Security Log Analytics Security Streaming NoSQL & Search Provisioning & coordination ML, Graph W orkflow & Data Governance Batch SQL INTEGRATED COMMERCIAL ENGINES TOOLSCOMPUTE ENGINES Batch Interactive Real-time Online Others Management Operations Governance Audits Security MapR-FS MapR-DB MapR Data Platform
- 23. © 2015 MapRTechnologies 23 Poll Question #2 Do you use Hadoop for Security Analytics? A. No, didn’t know it could be used for Security Analytics. B. Yes, it's been 6 months or less. C. Yes, it’s been deployed for 12 months or more. D. No, but considering it in the next 6-12 months.
- 24. © 2015 MapRTechnologies 24 What’s in the Quick Start Solution 6 nodes of MapR software 2 week engagement 3 Hadoop Professional Certifications
- 25. © 2015 MapRTechnologies 25 Quick Start Service Engagement Engagement includes: 1. Identification of data sources, transformations and reporting engines 2. Access and use of the solution template including source code 3. Training on customizing the solution template to the organization’s requirement 4. Deployment architecture document that enables a production deployment plan for the specific solution SOLUTION TEMPLATE KNOWLEDGE TRANSFER DEPLOYMENT ARCHITECTURE
- 26. © 2015 MapRTechnologies 26 Components of the Solution Template • Data Workflows – Read/collect input data – Handle bulk load and streaming use cases • Parsers and Enrichment – Process input data (filtering and deriving additional data as needed) – Storing in one or more data types or formats • Machine learning – Clustering analysis – Reservoir sampling analysis INTEGRATED COMMERCIAL ENGINES TOOLSCOMPUTE ENGINES MapR Data Platform
- 27. © 2015 MapRTechnologies 27 The Power of the Open Source Community APACHE HADOOP AND OSS ECOSYSTEM Security YARN Spark Streaming Storm StreamingNoSQL & Search Juju Provisioning & Coordination Sahara ML, Graph Mahout MLLib GraphX EXECUTION ENGINES DATA GOVERNANCE AND OPERATIONS Workflow & Data Governance Pig Cascading Spark Batch MapReduce v1 & v2 Tez HBase Solr Hive Impala Spark SQL Drill SQL Sentry Oozie ZooKeeperSqoop Flume Data Integration & Access HttpFS Hue Data PlatformMapR-FS MapR-DB Management
- 28. © 2015 MapRTechnologies 28 MapR: Best Solution for Customer Success Premier Investors High Growth 2X Growth In Direct Customers 90% Subscription Licenses Software Margins 140 % Dollar-based Net Expansion 700+ Customers 2X Growth In Annual Subscriptions ( ACV) Best Product Apache Open Source
- 29. © 2015 MapRTechnologies 29 Security Log Analytics Template MapR-FS MapR-DB
- 30. © 2015 MapRTechnologies 30 Resources https://www.mapr.com/solutions/quickstart/hadoop -security-log-analytics-quick-start – Research Report: The Evolution of Data Driven Security – Solution Brief: Jump-Start Security Log Analytics
- 31. © 2015 MapRTechnologies 31 Freeon-demand Hadoop training leading to certification Start becoming an expert now mapr.com/training 50MIn Free Training
- 32. © 2015 MapRTechnologies 32 Q&A @mapr maprtech [email protected] Engage with us! MapR maprtech mapr-technologies
- 33. © 2015 MapRTechnologies 33© 2015 MapR Technologies Security Log Analytics on MapR
- 34. © 2015 MapRTechnologies 34 Zions Bank: Security Analytics and Fraud Detection Cost effective security analytics and fraud detection on one platform • Fraud Operations and Security Analytics team at Zions maintains data stores, builds statistical models to detect fraud, and then uses these models to data mine and evaluate suspicious activity “We initially got into centralizing all of our data from an information security perspective. We then saw that we could use this same environment to help with fraud detection” Michael Fowkes - SVP Fraud Operations and Security Analytics • Existing technology infrastructure could not scale • Timeliness of reports degraded over the last several years • Chose MapR and cut storage costs by 50% • Querying time reduced from 24 hours to 30 min on 1.2 PB of data • Leverage MapR scale for increased model accuracy and deeper insights OBJECTIVES CHALLENGES SOLUTION Business Impact
- 35. © 2015 MapRTechnologies 35 Zions Bank with MapR – Faster Operations at Lower Costs Web Server Data Transactional Data 3rd Party Real Time Fraud Detection Reporting and Batch Analytics Deeper Analysis with Machine Learning PRD and Dev on MapR N F S Technical Benefits High availability Multi-tenancy Snapshots Performance Business Benefits Unified platform for data Lower operating costs Operational guarantees Faster model development
- 36. © 2015 MapRTechnologies 36 Solutionary: Managed Security Services Provider Threat detection on real-time streaming data via platform as a service • To address their growing customer base by processing trillions of messages (petabyte) per year while continuing to provide reliable security services • To improve data analytics by leveraging newer, more granular unstructured data sources ”MapR has taken Apache Hadoop to a new level of performance and manageability. It integrates into our systems seamlessly to help us boost the speed and capacity of data analytics for our clients.” - Dave Caplinger, Director of Architecture, Solutionary • Expanding existing database solution to meet demand was cost prohibitive • The existing technology could not process unstructured data at scale • Replaced RDBMS with MapR Enterprise Database Edition to scale Reduced time needed to investigate security events for relevance and impact • Improved data analytics, enabling new services and security analytics • 2x faster performance compared to competing solutions OBJECTIVES CHALLENGES SOLUTION Business Impact Leader in Magic Quadrant
- 37. © 2015 MapRTechnologies 37 Why MapR for Security Analytics Business • Large scale and deep analytics on security data to reduce risk • Early detection of advanced persistent threats and unknown threats • React fast on any abnormal or malicious activity from internal and external actors • Avoid fines, lawsuits, loss of business and negative PR Technical • Build a data vault for security event logs from multiple sources • With more data to scrutinize, get insights into anomalous behavior and close loop with other security solutions • Platform that enables analysis of both historical data as well as real-time analysis of large volumes of security data Operations • Fast ingestion of large volume of data and perform deep analytics • Easy integration with existing IT ecosystem • Low overhead to maintain system • Early detection of threats and closed loop feedback with existing security solutions
- 38. © 2015 MapRTechnologies 38 The MapR Advantage • Scale Reliability Across the Enterprise – Advanced multi-tenancy – Business continuity – HA, DR • Speed – 2-7x faster than other Hadoop distributions – Ultra-fast data ingest (100M data points per sec) – NFS & R/W file system • Real-time & Self-Service Data Exploration – On-the-fly SQL without up-front schema – Fast lookups and queries Best Hadoop Platform for Security Log Analytics Security Streaming NoSQL & Search Provisioning & coordination ML, Graph W orkflow & Data Governance Batch SQL INTEGRATED COMMERCIAL ENGINES TOOLSCOMPUTE ENGINES Batch Interactive Real-time Online Others Management Operations Governance Audits Security MapR-FS MapR-DB MapR Data Platform
- 39. © 2015 MapRTechnologies 39 Poll Question #2 Do you use Hadoop for Security Analytics? A. No, didn’t know it could be used for Security Analytics. B. Yes, it's been 6 months or less. C. Yes, it’s been deployed for 12 months or more. D. No, but considering it in the next 6-12 months.
- 40. © 2015 MapRTechnologies 40 What’s in the Quick Start Solution 6 nodes of MapR software 2 week engagement 3 Hadoop Professional Certifications
- 41. © 2015 MapRTechnologies 41 Quick Start Service Engagement Engagement includes: 1. Identification of data sources, transformations and reporting engines 2. Access and use of the solution template including source code 3. Training on customizing the solution template to the organization’s requirement 4. Deployment architecture document that enables a production deployment plan for the specific solution SOLUTION TEMPLATE KNOWLEDGE TRANSFER DEPLOYMENT ARCHITECTURE
- 42. © 2015 MapRTechnologies 42 Components of the Solution Template • Data Workflows – Read/collect input data – Handle bulk load and streaming use cases • Parsers and Enrichment – Process input data (filtering and deriving additional data as needed) – Storing in one or more data types or formats • Machine learning – Clustering analysis – Reservoir sampling analysis INTEGRATED COMMERCIAL ENGINES TOOLSCOMPUTE ENGINES MapR Data Platform
- 43. © 2015 MapRTechnologies 43 The Power of the Open Source Community APACHE HADOOP AND OSS ECOSYSTEM Security YARN Spark Streaming Storm StreamingNoSQL & Search Juju Provisioning & Coordination Sahara ML, Graph Mahout MLLib GraphX EXECUTION ENGINES DATA GOVERNANCE AND OPERATIONS Workflow & Data Governance Pig Cascading Spark Batch MapReduce v1 & v2 Tez HBase Solr Hive Impala Spark SQL Drill SQL Sentry Oozie ZooKeeperSqoop Flume Data Integration & Access HttpFS Hue Data PlatformMapR-FS MapR-DB Management
- 44. © 2015 MapRTechnologies 44 MapR: Best Solution for Customer Success Premier Investors High Growth 2X Growth In Direct Customers 90% Subscription Licenses Software Margins 140% Dollar-based Net Expansion 700+ Customers 2X Growth In Annual Subscriptions ( ACV) Best Product Apache Open Source
- 45. © 2015 MapRTechnologies 45 Security Log Analytics Template MapR-FS MapR-DB
- 46. © 2015 MapRTechnologies 46 Find more Resources on MapR.com or … Research Report The Evolution of Data Driven Security Solution Brief Jump-Start Security Log Analytics Webinar Recording Security Analytics and Big Data: What You Need to Know
Editor's Notes
- #6 Hacking mentality has changed: Less nuisance hacking More financially motivated Significant socio-political motivation (Nation-State) Significant industrial espionage Data breaches affect every industry Healthcare, Retail, Government, Education, Food Service… Organizations are being attacked from all sides External threats If Knowledge is power and money is power…Then Knowledge is Money That’s why attackers are after the data Insider threats Equivalent of IT Road-Rage All information is up for grabs Emails most compromised Credit Cards Second most PII most valuable per record Industrial and tech IP very valuable
- #7 EMA research identified several troubling statistics about identifying and responding to threats: 69% of organizations were between “Highly Doubtful” and only “Somewhat Confident” that they could detect an important security issue before it had a significant impact. Only 22% of organizations believe they are consistently successful in in correlating security data to business impact. Top frustrations with IT Security Practices: 41% too difficult to distinguish between legitimate and malicious activity technical issues. 33% said inadequate ability to report/communicate meaningful information to business stake holders (e.g. reporting to the board) Ponemon Institute identified that: 60% said their enterprises were unable to stop exploits because of outdated or insufficient threat intelligence.
- #11 SIEM technology provides real-time analysis of security alerts generated by network hardware and applications. (Wikipedia) This is limited “analysis” based primarily upon correlation and normalization of alerts. SIEM understands network information and log entries to correlate events at a network level and identify system/application alerts. SIEM only understands deltas for those things inside of its defined rules or policies SIEM does not understand human, system, and application specific activity and patterns (behaviors) to determine how some activities raise the threat level. Post notification SIEM requires manual investigation for details. EMA 55% of organizations said they still conduct manual incident investigations
- #14 Security Analytics leverages machine learning, Big Data scalability, Trend Analysis, behavioral analysis and other techniques to identify abnormal activities or trends by individual users, systems, and/or applications. 95% of organizations have heard about Security Analytics 70% said they either have or are actively pursuing a project to invest in it. Security Analytics Improvements: Better context and fidelity Reduce alert volumes Reduce False positives Provide better prioritization Accelerate Incident Response EMA Research identified that strong data analysis is key to success 95% of organizations that use Security Analytics said that the tool produced expected or greater than expected value. 90% of organizations using Security Analytics say have seen a reduction in false positives or an improvement in actionable alerts since they implemented a Security Analytics technology.
- #19 Global bank fraud costs $200B annually) Zions Bank Fights Fraud, Gains Insights and Cuts Data Storage Costs with MapR The Business Zions Bank, based in Salt Lake City, Utah, is a subsidiary of Zions Bancorporation that operates more than 500 offices and 600 ATMs in 10 Western U.S. states. As a full-service bank, Zions offers commercial, installment and mortgage loans; trust services; foreign banking services; electronic and online banking services; automatic deposit and nationwide banking and transfer services; as well as checking and savings programs. Challenge “Being a financial institution, we have a bull’s-eye painted on our backs,” says Michael Fowkes, Zions Bank SVP Fraud Operations and Security Analytics. “Crooks want to steal money, and banks are often a target, so fraud protection is critical to our business. If fraud gets out of control, it eats into our profitability.” The Zions Bank Fraud Operations and Security Analytics team maintains data stores, builds statistical models to detect fraud, and then uses these models to data mine and evaluate suspicious activity. Zions has been refining their solution over the past 8-9 years. Fowkes explains that about eight years ago they found that when they loaded in a lot of data, performance degraded significantly when they tried to do reporting. “We always kept our eye out for new data stores. When it came time to refresh our data stores, we decided to go to Hadoop,” says Fowkes. MapR Solution Zions Bank chose MapR for its security features, NFS mountable file system, high availability, ease of management and its superior performance capabilities, which allow for a more efficient use of hardware and a better ROI. The bank relies on MapR for a critical part of their security architecture. MapR helps Zions predict phishing behavior and payments fraud in real time and minimize their impact. With MapR, Zions can run more detailed analytics and forensics. Benefits The bank has seen multiple benefits from their MapR solution: Cuts storage costs in half Zions is seeing significant benefits from a storage perspective. With their other data sources, they had to hold on to source data sets so they still have the original data. MapR eliminates the need to have multiple data sources. “When we cut over to MapR, we cut our expenses in half from a data storage perspective,” says Fowkes. (Michael, do you need to get clearance on this quote?) Cost effective to scale Since MapR scales linearly, capacity planning is much easier. “We know that growth won’t be incredibly expensive like with distributed database platforms which charge per terabyte of storage. This can get quite expensive,” says Fowkes. “The others cost a lot more to scale. MapR allows us to scale at a reasonable price.” <Michael, can you provide any specific metrics about the difference in cost to scale with the MapR solution? > Increases accuracy, speed and insights Fowkes explains that before, when you created a statistical model, you had to use sample data. “MapR allows you to wrangle large amounts of data,” he says. “You can use all of your data and create a more accurate model. This is also used in forensics so we have one place to research what happened.” Two years of data add up to about 1.2 petabytes of data. Wrangling this amount of data used to be daunting. “In the past, it could take a full day. Now we can do a data query of two years of data in 30 minutes,” he says. Multiple uses for data stores Centralizing data stores serves multiple uses—from data security to fraud detection to risk management to customer marketing. “We initially got into centralizing all of our data from an information security perspective. We then saw that we could use this same environment to help with fraud detection,” he says. “Now that we have this data we know we can do more with it. Right now we’re working on a business project on the marketing side, completely outside of fraud and info security. It’s the same data to look at on the business side for customer analytics,” he says. “And our risk group leverages data that’s used in the system too. Having a more granular view of data, you get additional insights.” Summary MapR is enabling Zions Bank to improve its security infrastructure while reducing costs. They’ve been able to cut storage costs in half, scale their solution cost-effectively, make more efficient use of hardware, make statistical models more accurate, increase the performance and speed of high volume data queries, generate deeper insights and help them leverage their data stores across several aspects of the business.
- #21 Objectives: As a leading Managed Security Service Provider (MSSP) in North America, Solutionary delivers managed security services and professional consulting services to mid-sized organizations and global enterprises. They wanted a platform that can scale effectively to address their growing customer base by processing trillions of messages (petabyte) per year while continuing to provide reliable security services. They also wanted to improve data analytics by leveraging newer, more granular unstructured data sources Challenges: Founded in 2000, the company uses proprietary security analytics technology to reduce risk, increase data security, and support compliance initiatives for its clients. They had challenges around increasing data analytics capabilities to improve clients’ security. They had issues scaling the current solution based on RDBMS as number of clients and data volume grow. Solution: The MapR M7 Enterprise Edition for Apache Hadoop, a Cisco Compatible product used by Solutionary, leverages an architecture designed specifically for high availability to offer advanced features not available with other Hadoop distributions. The MapR Direct Access NFS feature delivers true industry-standard NFS that enables Solutionary to smoothly integrate with existing systems without sacrificing performance. Data snapshots and mirroring provide reliable data protection for enhanced data security, while monitoring through the MapR Heatmap enables staff to view cluster health and current capacity at a glance. Business impact: Detection of advanced and sophisticated attacks through analysis of unstructured data while linking enriched structured asset and contextual data Reduced time needed to investigate security events for relevance and impact Achieved performance and flexibility with incredible scalability via Hadoop’s clustered infrastructure. This infrastructure allows them to perform real-time analysis on big data in order to help protect and defend against sophisticated, organized, and state-sponsored adversaries Solutionary Case study http://www.mapr.com/sites/default/files/solutionary-cisco-case-study_1.pdf
- #22 The solution benefits the typical and most encountered audiences: What do CISOs/CIOs get - large scale and deep analytics on security data to reduce risk that helps them with early detection of advanced persistent threats and unknown threats. It allows organizations to reach faster on any abnormal or malicious activity from internal and external actors and be able to avoid fines, lawsuits, loss of business and negative PR. For the technical and operations team, you can build a data vault for security event logs from multiple sources. With more data to scrutinize, get insights into anomalous behavior and close loop with other security solutions. The platform is easy to administer and integrate with existing IT ecosystem.
- #23 Why MapR is the best Hadoop Platform for Data warhouse optimization? For business-critical applications you must have data protection and security (availability, data protection, and recovery), high performance (with random read-write system), multi-tenancy (to support multiple business units, isolate applications or user data,…), provide good resource and workload management to support multiple applications, and open standards to integrate with the rest of the IT ecosystem. You also need a platform that is capable of super fast data ingestion from multiple sources and be able to make critical analytics and decisions at speed (in milliseconds), and at scale. Examples include breach detection based on information from multiple sources, fraud detection on millions of transactions that are based on individual patterns, fleet management and routing taking into account current conditions….This requires a Hadoop platform that can go beyond batch and support streaming writes so data can be constantly writing to the system while analysis is being conducted. High performance to meet the business needs and real-time operations the ability to perform online database operations to react to the business situation and impact business as it happens not report on it one week, month or quarter later. Data Agility is needed for Business Agility. Drill provides instant ANSI SQL for Hadoop & NoSQL. You can explore data in its native format without expensive and time consuming transformation. You can analyze evolving and semi-structured/nested data from NoSQL databases, find what is of value and THEN model this in your DW schema for downstream ad-hoc reporting by 100’s or 1000’s of concurrent users.
- #27 Why MapR is the best Hadoop Platform for Security Log Analytics? For business-critical applications you must have data protection and security (availability, data protection, and recovery), high performance (with random read-write system), multi-tenancy (to support multiple business units, isolate applications or user data,…), provide good resource and workload management to support multiple applications, and open standards to integrate with the rest of the IT ecosystem. You also need a platform that is capable of super fast data ingestion from multiple sources and be able to make critical analytics and decisions at speed (in milliseconds), and at scale. Examples include breach detection based on information from multiple sources, fraud detection on millions of transactions that are based on individual patterns, fleet management and routing taking into account current conditions….This requires a Hadoop platform that can go beyond batch and support streaming writes so data can be constantly writing to the system while analysis is being conducted. High performance to meet the business needs and real-time operations the ability to perform online database operations to react to the business situation and impact business as it happens not report on it one week, month or quarter later. Data Agility is needed for Business Agility. Drill provides instant ANSI SQL for Hadoop & NoSQL. You can explore data in its native format without expensive and time consuming transformation. You can analyze evolving and semi-structured/nested data from NoSQL databases.
- #28 The power of MapR begins with the power of open source innovation and community participation. In some cases MapR leads the community in projects like Apache Mahout (machine learning) or Apache Drill (SQL on Hadoop) In other areas, MapR contributes, integrates Apache and other open source software (OSS) projects into the MapR distribution, delivering a more reliable and performant system with lower overall TCO and easier system management. MapR releases a new version with the latest OSS innovations on a monthly basis. We add 2-4 new Apache projects annually as new projects become production ready and based on customer demand.
- #29 The MapR distribution for Hadoop is globally recognized as the technology leader Forrester published a Wave for Big Data Hadoop Solutions where it placed MapR as the highest ranking product based on current offering as well as roadmap. Cloud: MapR has been selected by two of the companies most experienced with MapReduce technology which is a testament to the technology advantages of MapR’s distribution. Amazon through its Elastic MapReduce service (EMR) hosted over 2 million clusters in the past year. Amazon selected MapR to complement EMR as the only commercial Hadoop distribution being offered, sold and supported as a service by Amazon to its customers. MapR was also selected by Google – the pioneer of MapReduce and the company whose white paper on MapReduce inspired the creation of Hadoop – has also selected MapR to make our distribution available on Google Compute Engine.
- #35 Global bank fraud costs $200B annually) Zions Bank Fights Fraud, Gains Insights and Cuts Data Storage Costs with MapR The Business Zions Bank, based in Salt Lake City, Utah, is a subsidiary of Zions Bancorporation that operates more than 500 offices and 600 ATMs in 10 Western U.S. states. As a full-service bank, Zions offers commercial, installment and mortgage loans; trust services; foreign banking services; electronic and online banking services; automatic deposit and nationwide banking and transfer services; as well as checking and savings programs. Challenge “Being a financial institution, we have a bull’s-eye painted on our backs,” says Michael Fowkes, Zions Bank SVP Fraud Operations and Security Analytics. “Crooks want to steal money, and banks are often a target, so fraud protection is critical to our business. If fraud gets out of control, it eats into our profitability.” The Zions Bank Fraud Operations and Security Analytics team maintains data stores, builds statistical models to detect fraud, and then uses these models to data mine and evaluate suspicious activity. Zions has been refining their solution over the past 8-9 years. Fowkes explains that about eight years ago they found that when they loaded in a lot of data, performance degraded significantly when they tried to do reporting. “We always kept our eye out for new data stores. When it came time to refresh our data stores, we decided to go to Hadoop,” says Fowkes. MapR Solution Zions Bank chose MapR for its security features, NFS mountable file system, high availability, ease of management and its superior performance capabilities, which allow for a more efficient use of hardware and a better ROI. The bank relies on MapR for a critical part of their security architecture. MapR helps Zions predict phishing behavior and payments fraud in real time and minimize their impact. With MapR, Zions can run more detailed analytics and forensics. Benefits The bank has seen multiple benefits from their MapR solution: Cuts storage costs in half Zions is seeing significant benefits from a storage perspective. With their other data sources, they had to hold on to source data sets so they still have the original data. MapR eliminates the need to have multiple data sources. “When we cut over to MapR, we cut our expenses in half from a data storage perspective,” says Fowkes. (Michael, do you need to get clearance on this quote?) Cost effective to scale Since MapR scales linearly, capacity planning is much easier. “We know that growth won’t be incredibly expensive like with distributed database platforms which charge per terabyte of storage. This can get quite expensive,” says Fowkes. “The others cost a lot more to scale. MapR allows us to scale at a reasonable price.” <Michael, can you provide any specific metrics about the difference in cost to scale with the MapR solution? > Increases accuracy, speed and insights Fowkes explains that before, when you created a statistical model, you had to use sample data. “MapR allows you to wrangle large amounts of data,” he says. “You can use all of your data and create a more accurate model. This is also used in forensics so we have one place to research what happened.” Two years of data add up to about 1.2 petabytes of data. Wrangling this amount of data used to be daunting. “In the past, it could take a full day. Now we can do a data query of two years of data in 30 minutes,” he says. Multiple uses for data stores Centralizing data stores serves multiple uses—from data security to fraud detection to risk management to customer marketing. “We initially got into centralizing all of our data from an information security perspective. We then saw that we could use this same environment to help with fraud detection,” he says. “Now that we have this data we know we can do more with it. Right now we’re working on a business project on the marketing side, completely outside of fraud and info security. It’s the same data to look at on the business side for customer analytics,” he says. “And our risk group leverages data that’s used in the system too. Having a more granular view of data, you get additional insights.” Summary MapR is enabling Zions Bank to improve its security infrastructure while reducing costs. They’ve been able to cut storage costs in half, scale their solution cost-effectively, make more efficient use of hardware, make statistical models more accurate, increase the performance and speed of high volume data queries, generate deeper insights and help them leverage their data stores across several aspects of the business.
- #37 Objectives: As a leading Managed Security Service Provider (MSSP) in North America, Solutionary delivers managed security services and professional consulting services to mid-sized organizations and global enterprises. They wanted a platform that can scale effectively to address their growing customer base by processing trillions of messages (petabyte) per year while continuing to provide reliable security services. They also wanted to improve data analytics by leveraging newer, more granular unstructured data sources Challenges: Founded in 2000, the company uses proprietary security analytics technology to reduce risk, increase data security, and support compliance initiatives for its clients. They had challenges around increasing data analytics capabilities to improve clients’ security. They had issues scaling the current solution based on RDBMS as number of clients and data volume grow. Solution: The MapR M7 Enterprise Edition for Apache Hadoop, a Cisco Compatible product used by Solutionary, leverages an architecture designed specifically for high availability to offer advanced features not available with other Hadoop distributions. The MapR Direct Access NFS feature delivers true industry-standard NFS that enables Solutionary to smoothly integrate with existing systems without sacrificing performance. Data snapshots and mirroring provide reliable data protection for enhanced data security, while monitoring through the MapR Heatmap enables staff to view cluster health and current capacity at a glance. Business impact: Detection of advanced and sophisticated attacks through analysis of unstructured data while linking enriched structured asset and contextual data Reduced time needed to investigate security events for relevance and impact Achieved performance and flexibility with incredible scalability via Hadoop’s clustered infrastructure. This infrastructure allows them to perform real-time analysis on big data in order to help protect and defend against sophisticated, organized, and state-sponsored adversaries Solutionary Case study http://www.mapr.com/sites/default/files/solutionary-cisco-case-study_1.pdf
- #38 The solution benefits the typical and most encountered audiences: What do CISOs/CIOs get - large scale and deep analytics on security data to reduce risk that helps them with early detection of advanced persistent threats and unknown threats. It allows organizations to reach faster on any abnormal or malicious activity from internal and external actors and be able to avoid fines, lawsuits, loss of business and negative PR. For the technical and operations team, you can build a data vault for security event logs from multiple sources. With more data to scrutinize, get insights into anomalous behavior and close loop with other security solutions. The platform is easy to administer and integrate with existing IT ecosystem.
- #39 Why MapR is the best Hadoop Platform for Data warhouse optimization? For business-critical applications you must have data protection and security (availability, data protection, and recovery), high performance (with random read-write system), multi-tenancy (to support multiple business units, isolate applications or user data,…), provide good resource and workload management to support multiple applications, and open standards to integrate with the rest of the IT ecosystem. You also need a platform that is capable of super fast data ingestion from multiple sources and be able to make critical analytics and decisions at speed (in milliseconds), and at scale. Examples include breach detection based on information from multiple sources, fraud detection on millions of transactions that are based on individual patterns, fleet management and routing taking into account current conditions….This requires a Hadoop platform that can go beyond batch and support streaming writes so data can be constantly writing to the system while analysis is being conducted. High performance to meet the business needs and real-time operations the ability to perform online database operations to react to the business situation and impact business as it happens not report on it one week, month or quarter later. Data Agility is needed for Business Agility. Drill provides instant ANSI SQL for Hadoop & NoSQL. You can explore data in its native format without expensive and time consuming transformation. You can analyze evolving and semi-structured/nested data from NoSQL databases, find what is of value and THEN model this in your DW schema for downstream ad-hoc reporting by 100’s or 1000’s of concurrent users.
- #43 Why MapR is the best Hadoop Platform for Security Log Analytics? For business-critical applications you must have data protection and security (availability, data protection, and recovery), high performance (with random read-write system), multi-tenancy (to support multiple business units, isolate applications or user data,…), provide good resource and workload management to support multiple applications, and open standards to integrate with the rest of the IT ecosystem. You also need a platform that is capable of super fast data ingestion from multiple sources and be able to make critical analytics and decisions at speed (in milliseconds), and at scale. Examples include breach detection based on information from multiple sources, fraud detection on millions of transactions that are based on individual patterns, fleet management and routing taking into account current conditions….This requires a Hadoop platform that can go beyond batch and support streaming writes so data can be constantly writing to the system while analysis is being conducted. High performance to meet the business needs and real-time operations the ability to perform online database operations to react to the business situation and impact business as it happens not report on it one week, month or quarter later. Data Agility is needed for Business Agility. Drill provides instant ANSI SQL for Hadoop & NoSQL. You can explore data in its native format without expensive and time consuming transformation. You can analyze evolving and semi-structured/nested data from NoSQL databases.
- #44 The power of MapR begins with the power of open source innovation and community participation. In some cases MapR leads the community in projects like Apache Mahout (machine learning) or Apache Drill (SQL on Hadoop) In other areas, MapR contributes, integrates Apache and other open source software (OSS) projects into the MapR distribution, delivering a more reliable and performant system with lower overall TCO and easier system management. MapR releases a new version with the latest OSS innovations on a monthly basis. We add 2-4 new Apache projects annually as new projects become production ready and based on customer demand.
- #45 The MapR distribution for Hadoop is globally recognized as the technology leader Forrester published a Wave for Big Data Hadoop Solutions where it placed MapR as the highest ranking product based on current offering as well as roadmap. Cloud: MapR has been selected by two of the companies most experienced with MapReduce technology which is a testament to the technology advantages of MapR’s distribution. Amazon through its Elastic MapReduce service (EMR) hosted over 2 million clusters in the past year. Amazon selected MapR to complement EMR as the only commercial Hadoop distribution being offered, sold and supported as a service by Amazon to its customers. MapR was also selected by Google – the pioneer of MapReduce and the company whose white paper on MapReduce inspired the creation of Hadoop – has also selected MapR to make our distribution available on Google Compute Engine.