SplunkLive! London 2017 - Building an Analytics Driven Security Operation Centre using Splunk Enterprise Security
ā¢
11 likesā¢2,585 views
This document discusses building an analytics-driven security operations center (SOC). It begins with an overview of traditional SOCs and their limitations, such as focusing primarily on alerts. It then discusses emerging trends in security operations that are driving the need for an analytics-driven SOC, such as the focus on detection and response. The document proposes seven enablers for building an analytics-driven SOC using Splunk, including selecting the right sourcing strategy, adopting an adaptive security architecture, optimizing threat intelligence management, deploying advanced analytics like machine learning, enabling proactive threat hunting, promoting automation and efficiency, and driving broader enterprise insights.
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Viewers also liked
Viewers also liked (19)
Similar to SplunkLive! London 2017 - Building an Analytics Driven Security Operation Centre using Splunk Enterprise Security
Similar to SplunkLive! London 2017 - Building an Analytics Driven Security Operation Centre using Splunk Enterprise Security (20)
More from Splunk
More from Splunk (20)
Recently uploaded
Recently uploaded (20)
SplunkLive! London 2017 - Building an Analytics Driven Security Operation Centre using Splunk Enterprise Security
- 1. Ā© 2017 SPLUNK INC. Building the Analytics-Driven SOC James Hanlon, Security Markets Specialist, EMEA Johan Bjerke, Security Staff Engineer, UK MAY 11, 2017 | LONDON
- 2. Ā© 2017 SPLUNK INC. 1. A look at traditional security operations 2. Security operations emerging trends 3. How to use Splunk for an Analytics- Driven SOC Agenda
- 3. Ā© 2017 SPLUNK INC. Traditional Security Operations
- 4. Ā© 2017 SPLUNK INC. A SOC By Any Other Nameā¦ ā¶ Security Analytics Center ā¶ Cyber Fusion Center ā¶ Cyber Defense Center ā¶ Threat Defense Center ā¶ Detection and Response Teams A centralized unit that deals with security on an organizational & technical level Security Operations Center (SOC) Cyber Defense Center (CDC) A team composed primarily of security analysts organized to detect, analyze, respond to, report on, and prevent cybersecurity incidents
- 5. Ā© 2017 SPLUNK INC. āA perception of the SOC as a big alert pipeline is outdated and does not allow the organization to make use of more active processes such as internal Threat Intelligence generation and Threat Hunting.ā ā [1] Anton Chuvakin https://www.gartner.com/doc/3479617 Traditional SOC Alert Pipeline?
- 6. Ā© 2017 SPLUNK INC. Hybrid OutsourceInsource Types of Traditional SOCsā¦ 10 Strategies of a World Class Cybersecurity Operations Center, Mitre 2014 Virtual Small Large Tiered National Choices?
- 7. Ā© 2017 SPLUNK INC. Should or Can I build a SOC? ā¶ Objectives & Business Alignment ā¶ Motivation >> Cost ā¶ Industry Guidance ā¶ Data Visibility ā¶ Staff Acquisition & Retention ā¶ Sourcing Models ā¶ Automation & Efficiency ā¶ Service Catalogue Expansion Challenges of traditional Security Operations Security Operations Objectives & Business Alignment Cost Industry Guidance Data Visibility Staffing Sourcing Models Automation & Efficiency Service Catalogue Expansion
- 8. Ā© 2017 SPLUNK INC. Many how-to guidesā¦but little prescriptive guidance
- 9. Ā© 2017 SPLUNK INC. The Critical Challenge: Balancing Security Priorities & Business Alignment Security Operations: only part of the bigger pictureā¦ Security Architecture Risk and Compliance Security Engineering Security Operations Includes SOC https://www.sans.org/security-resources/posters/leadership/security-leadership- poster-135
- 10. Ā© 2017 SPLUNK INC. Emerging Trends in Security Operations
- 11. Ā© 2017 SPLUNK INC. To meet the challenges of the new "detection and response" paradigm, an intelligence- driven SOC also needs to move beyond traditional defenses, with an adaptive architecture and context-aware components. To support these required changes in information security programs, the traditional SOC must evolve to become the intelligence- driven SOC (ISOC) with automation and orchestration of SOC processes being a key enabler. Gartner, 2016 The desire for a better SOC is clear.. http://www.gartner.com/newsroom/id/3347717 Splunk EMEA CISO SOC RoundTable ļ¼ Know what your SOC needs to achieve! ļ¼ Align to business! ļ¼ Build business support ļ¼ Build a strategic roadmap ļ¼ Address people challenges and cost strategies early ļ¼ Define data sources for SOC insights ļ¼ Select technology wisely Splunk CISOās, 2016
- 12. Ā© 2017 SPLUNK INC. Three Interrelated Components of Security Process PeopleTechnology [2017 FOCUS] [2017 FOCUS] [Automation & Analytics is the Driving Force]
- 13. Ā© 2017 SPLUNK INC. 1. Threat Monitoring 2. Incident Investigation 3. Incident Response Defining the SOC Service Catalogue āWhat do you need to achieve?ā 4. Operational Reporting 5. Business Reporting! Mapping the Service Catalogue Splunk SOC Optimisation Workshop
- 14. Ā© 2017 SPLUNK INC. Example Documented Service Catalogue Services Catalogue ā Announcements & advisories ā Alerts & warnings ā Incident response, support & analysis ā Artefact analysis ā Cyber threat intelligence ā IDS & log management ā Vulnerability assessment
- 15. Ā© 2017 SPLUNK INC. ā¶ Tier-1Triage ā¶ Off hours ā¶ Tool Engineering ā¶ Outside Help With Specialties ā¢ Reverse Engineering ā¢ Forensics ā¢ Advanced IR ā¢ Red/Purple teaming Hybrid Models (i.e. Int SOC platform + MSS) are becoming more common
- 16. Ā© 2017 SPLUNK INC. ā¶ Big Data Log Platform (BLDP) ā¶ User Behavior Analytics (UBA) ā¶ Threat intelligence (TI) (consumption, creation & sharing) ā¶ Threat Hunting (TH) ā¶ Threat & Vulnerability Management (TVM) ā¶ Security Incident Response (SIR) ā¶ Security Operations Automation (SOA) New Automation & Tooling Opportunities in the SOC Security Operations Big Data Log Platform (BDLP) User Behavior Analytics (UBA) Threat intelligence (TI) Threat Hunting (TH) Threat & Vulnerability Management (TVM) Security Incident Response (SIR) Security Operations Automation (SOA)
- 17. Ā© 2017 SPLUNK INC. ā¦ effort by analysts who purposely set out to identify and counteract adversaries that may already be in the environment. https://www.sans.org/reading-room/whitepapers/analyst/ who-what-where-when-effective-threat-hunting-36785 āThreat Huntingā
- 18. Ā© 2017 SPLUNK INC. ā¶ Start with a hypothesis that considers: ā¢ Situational Awareness (often crown jewels focused) ā¢ Threat Intelligence ā¢ Domain experience ā¢ Best Results > all 3! ā¶ Requires lots of data ā¶ Flexible platform to ask/answer questions ā¶ Process Automation ā¶ Data science / ML / Analytics increasingly used How are SOC Teams Hunting? https://www.sans.org/reading-room/whitepapers/analyst/who-what-where-when-effective-threat-hunting-36785
- 19. Ā© 2017 SPLUNK INC. SOC Persona Responsible for the operations, technology, team and leadership Responsible for the technology, product, upgrades SIEM Admin, Tools Engineer Security Analyst Hunter, Incident Responder SecOps / SOC Manager / Director CISO / Head InfoSec Responsible for investigating alerts, incidents and triage Responsible for SOC process, initiatives, often budget Proactively/reactively hunts for threats. Head or Exec of Info Security, Security Considerations: Hiring & Retention Shift Rotations & Coverage Skills Development Business Engagement
- 20. Ā© 2017 SPLUNK INC. Calculating the Staff Requirements & Costs Mapping the Staffing Requirements & Costs Splunk SOC Optimisation Workshop
- 21. Ā© 2017 SPLUNK INC. ā Fast data onboarding ā Any data source ā Easy correlation ā Automation / integration ā Performant and scalable ā Full fidelity ā Retention and integrity ā Normalized ā Enables Hunting ā Forensic investigation ā Alerting ā User access controls ā Flexible Visualization ā Advanced Analytics (ML?) Critical Characteristics for Log Data Platforms
- 22. Ā© 2017 SPLUNK INC. 1. Assets and Identities 2. Threat intel 3. Firewall 4. Network metadata 5. Authentication 6. Server (Windows / Linux) 7. Endpoint 8. IDS / IPS 9. VPN 10.Application 11.Vulnerability Common SOC Data Sources Mapping the Data source Requirements Splunk Security Data Source Assessment
- 23. Ā© 2017 SPLUNK INC. Challenges to building you own custom cyber data lake: ā¶ Dirty data ā¶ Debugging custom big data collectors ā¶ Accessing data ā¶ Little value beyond collection ā¶ Little value beyond keyword searching ā¶ Little threat detection value ā¶ Ability to find, retain & integrate skills needed Build your own custom cyber security data lake? http://blogs.gartner.com/anton-chuvakin/2017/04/11/why-your-security-data-lake-project-will-fail/
- 24. Ā© 2017 SPLUNK INC. Splunk for Analytics-Driven SOC
- 25. Ā© 2017 SPLUNK INC. 1. Select the right sourcing strategy 2. Adopt an adaptive security architecture 3. Optimise threat intelligence management 4. Deploy advanced analytics 5. Proactive investigation & threat hunting 6. Promote security automation & human efficiency 7. Drive Enterprise āNot Justā Security Insights ā7 Enablersā of the Analytics Driven SOC
- 26. Ā© 2017 SPLUNK INC. Splunk as the Nerve Center Identity and Access Internal Network Security Endpoints OrchestrationWAF & App Security Threat Intelligence Network Web Proxy Firewall
- 27. Ā© 2017 SPLUNK INC. Splunk Security Portfolio ā¢ Risky behavior detection ā¢ Advanced attacks & insider ā¢ Entity & kill chain profiling Enterprise Security Response ā¢ Security analytics (SOC) platform ā¢ Incident response workflow ā¢ Adaptive response ā¢ OOB key security metrics Splunk Enterprise Detection Realm of Known Human-driven Splunk Security Essentials/UBA Detection Realm of Unknown ML-driven ā¢ Any data log aggregation ā¢ Rules, statistics, correlation ā¢ Search, visualize & hunt
- 28. Ā© 2017 SPLUNK INC. Splunk Enterprise Security A collection of orchestration frameworks for SOC Operations NOTABLE EVENT THREAT INTELLIGENCE ASSET AND IDENTITY CORRELATION ADAPTIVE RESPONSE RISK ANALYSIS Platform for Operational Intelligence
- 29. Ā© 2017 SPLUNK INC. A Recipe for the Security Analytics Driven SOC Event Aggregation Incident Creation Investigation & Response Investigative Platform ā¶ Flexible Analyst Visualisation ā¶ Provide automation with security solutions & tooling ā¶ Security operations orchestration & threat hunting Simple Detection ā¶ Rules & Statistics ā¶ Quick development ā¶ Easy for analysts Advanced Detection ā¶ Detect unknown ā¶ New vectors ā¶ Machine learning Event Management ā¶ Fast data onboarding ā¶ Manage High Volume ā¶ Track Entity Relationships Alert Management Incident Contextualization (Enrichment) Decrease MTTR
- 30. Ā© 2017 SPLUNK INC. 1. Select the right sourcing strategy 2. Adopt an adaptive security architecture 3. Optimise threat intelligence management 4. Deploy advanced analytics 5. Proactive investigation & threat hunting 6. Promote security automation & human efficiency 7. Drive Enterprise āNot Justā Security Insights ā7 Enablersā of the Analytics Driven SOC
- 31. Ā© 2017 SPLUNK INC. 1. Select an Appropriate SOC Sourcing Strategy 1 2 3 4 On Premise Cloud Only Hybrid Spilt Technology & SOC Provider Model ā¶ To Prevent, Detect, Respond and Predict
- 32. Ā© 2017 SPLUNK INC. Customer ā¶ UKās largest building and construction supplier ā¶ 20+ business units in group & 27,0000 employees Challenges ā¶ Failed previous SIEM project ā¶ Complex mix of legacy on premise and cloud solutions ā¶ Difficult ingesting data sources for visibility ā¶ Limited security personnel Customer Solution: Splunk Enterprise & Splunk Enterprise Security) ā¶ Fast time from data ingestion to obtaining security insight ā¶ Splunk Cloud removes pain from managing host infrastructure ā¶ Intrinsic Splunk ES risk scoring has been pivotal in multiple cyber incidents ā¶ Architecture design now serving non security use cases (IT Event Monitoring) RETAIL Building a Lean āCloudā SOC Splunk Security: Fast Time to Value
- 33. Ā© 2017 SPLUNK INC. 1. Select the right sourcing strategy 2. Adopt an adaptive security architecture 3. Optimise threat intelligence management 4. Deploy advanced analytics 5. Proactive investigation & threat hunting 6. Promote security automation & human efficiency 7. Drive Enterprise āNot Justā Security Insights ā7 Enablersā of the Analytics Driven SOC
- 34. Ā© 2017 SPLUNK INC. ā¶ Correlation across all security relevant data ā¶ Insights from existing security architectures ā¶ Advanced analytics techniques such as machine learning 2. Adopt an Adaptive Security Architecture To Prevent, Detect, Respond and Predict 1,000+ Apps and Add-ons Splunk Security Solutions
- 35. Ā© 2017 SPLUNK INC. 1. Select the right sourcing strategy 2. Adopt an adaptive security architecture 3. Optimise threat intelligence management 4. Deploy advanced analytics 5. Proactive investigation & threat hunting 6. Promote security automation & human efficiency 7. Drive Enterprise āNot Justā Security Insights ā7 Enablersā of the Analytics Driven SOC
- 36. Ā© 2017 SPLUNK INC. ā¶ Automatically collect, aggregate and de-duplicate threat feeds from a broad set of sources ā¶ Support for STIX/TAXII, OpenIOC, Facebook ā¶ Build your own data to create your own Threat Intel ā¶ Out of the box Activity and Artifact dashboards 3. Threat Intelligence ā ES Threat Intel Framework ā¶ Determine impact on network, assets ā¶ Use for analysis / IR ā¶ Collect / provide forensics ā¶ Use to hunt / uncover / link events ā¶ Share info with partners Law Enforcement Feeds ISAC Feeds Agency Feed Commercial Service Community Feed Open-Source Feed Other Enrichment Services
- 37. Ā© 2017 SPLUNK INC. Customer ā¶ EU Intuitions own Computer Emergency Response Team (CERT) ā¶ Supports 60 organizations across Europe supporting 100,000 end users Challenges ā¶ Ingestion from many sources ā¶ Constituents: very high value targets ā¶ Complex decentralized, heterogeneous environment ā¶ Need to correlate everything with everything: file-less lateral movements, bypassing protection layers, phishing attacks Customer Solution: Splunk Enterprise ā¶ Provides common language and conventions to control all data (CIM) ā¶ Drives time saving & reduces human error while increased visibility ā¶ Enables any data & intelligence correlation. Easily integrates with custom security tooling via open APIās ā¶ Two tier architecture with end users in control of their data GOVERNMENT Enabling EU Cyber Response Splunk Security: Trusted vhttps://de.slideshare.net/Splunk/splunk-live-utrecht-2016-cert-eu
- 38. Ā© 2017 SPLUNK INC. Demo: Proactively Managing Threat Intelligence [Splunk Enterprise Security Threat Intelligence Management]
- 39. Ā© 2017 SPLUNK INC. 1. Select the right sourcing strategy 2. Adopt an adaptive security architecture 3. Optimise threat intelligence management 4. Deploy advanced analytics 5. Proactive investigation & threat hunting 6. Promote security automation & human efficiency 7. Drive Enterprise āNot Justā Security Insights ā7 Enablersā of the Analytics Driven SOC
- 40. ā¢ Accelerate anomaly and unknown threat detection ā minimize attacks & insider threat ā¢ Use Splunk Security Essentials App ā FOC App with 55+ UBA use cases ā¢ Premium Machine learning solution ā Splunk User Behavior Analytics ā Flexible workflows for SOC Manager, SOC analyst and Hunter/Investigator within SIEM 4. Deploy Advanced Analytics ā Native ML and UBA To Prevent, Detect, Respond and Predict: Security Essentials App UBA Premium Solution Premium Solution Integration
- 41. Ā© 2017 SPLUNK INC. Demo: Deploying Advanced Analytics [Join us at the next security session to see the live demo!]
- 42. Ā© 2017 SPLUNK INC. 1. Select the right sourcing strategy 2. Adopt an adaptive security architecture 3. Optimise threat intelligence management 4. Deploy advanced analytics 5. Proactive investigation & threat hunting 6. Promote security automation & human efficiency 7. Drive Enterprise āNot Justā Security Insights ā7 Enablersā of the Analytics Driven SOC
- 43. Ā© 2017 SPLUNK INC. 5. Proactive Investigation & Threat Hunting Enrichment Automation Search & Visualization Hypotheses Automated Analytics Data Science and Machine Learning Data and Intelligence Enrichment Data Search Visualisation Threat Hunting Enablement Integrated & out of the box automation tooling from artifact query, contextual āswim-lane analysisā, anomaly & time series analysis to advanced data science leveraging machine learning Threat Hunting Data Enrichment Enrich data with context and threat-intel across the stack or time to discern deeper patterns or relationships Search & Visualize Relationships for Faster Hunting Search and correlate data while visually fusing results for faster context, analysis and insight Ingest & Onboard Any Threat Hunting Machine Data Source Enable fast ingestion of any machine data through efficient indexing, a big data real time architecture and āschema on the readā technology DATA MATURITY
- 44. Ā© 2017 SPLUNK INC. Customer ā¶ Third largest retail bank in Switzerland with 3m+ customer ā¶ No 1 online payments provider Challenges ā¶ Protecting financial assets & customer is a top priority ā¶ Data ingestion and security insight ā¶ Highly manual security analysis and reporting ā¶ Cultural and organizational barriers to optimal security Customer Solution: Splunk Enterprise ā¶ Risk reduction through E-payment & debit card fraud detection ā¶ Increased visibility & security automation for online banking, payment processing, customer data protection such as phishing attack workflows FINANCE Connecting Business & Security at a Swiss Bank Splunk Security: Business Value https://conf.splunk.com/session/2015/conf2015_PHoffman_PostFinance_UsingSplunkSearchLanguage_HowSplunkConnectsBusiness.pdf
- 45. Ā© 2017 SPLUNK INC. 1. Select the right sourcing strategy 2. Adopt an adaptive security architecture 3. Optimise threat intelligence management 4. Deploy advanced analytics 5. Proactive investigation & threat hunting 6. Promote security automation & human efficiency 7. Drive Enterprise āNot Justā Security Insights ā7 Enablersā of the Analytics Driven SOC
- 46. Ā© 2017 SPLUNK INC. ā¶ Use rules to automate routine aspects of detection and investigation ā¶ Extract insights from existing security controls by use of common interface ā¶ Take actions with confidence for faster decisions and response ā¶ Automate any process along the continuous monitoring, response and analytics cycle 6. Promote Security Automation & Human Efficiency To Prevent, Detect, Respond and Predict: Identity and Access Internal Network Security Endpoints OrchestrationWAF & App Security Threat Intelligence Network Web Proxy Firewall + Splunk Adaptive Response Alliance
- 47. Ā© 2017 SPLUNK INC. Demo: Driving Automation [Splunk Enterprise Security Adaptive Response]
- 48. Ā© 2017 SPLUNK INC. 1. Select the right sourcing strategy 2. Adopt an adaptive security architecture 3. Optimise threat intelligence management 4. Deploy advanced analytics 5. Proactive investigation & threat hunting 6. Promote security automation & human efficiency 7. Drive Enterprise āNot Justā Security Insights ā7 Enablersā of the Analytics Driven SOC
- 49. Ā© 2017 SPLUNK INC. SECURITY & RISK IT OPERATIONS BUSINESS ANALYTICS SAME DATA Of theAsking differentDifferent PEOPLE QUESTIONS 40-70%security data that can be re-used for additional non security business value Online Services SplunkCustomer ValueExamples $11m Benefit Increased revenue from higher uptime High Tech $25m Benefit Increased revenue from higher uptime Oil & Gas $200m Benefit Revenues from Preventing APTās Transportation $1b Benefit Optimisation with Sensor Data 7.From Security to Enterprise Data Insights
- 50. Ā© 2017 SPLUNK INC. Customer ā¶ Operate in 60 counties with over 45,000 Employees ā¶ 29 engineering and project execution centers and 5 fabrication yards Challenges ā¶ Needed to gain operational visibility into distributed infrastructure ā¶ Unable to meet compliance needs (PCI, ISO27001, SOX, Privacy) ā¶ Struggling with governance of IT Operations ā¶ Inability to reports holistically across all domains Customer Solution (Splunk Enterprise) ā¶ Real time data insights across Security, ITOps & Application Development ā¶ LoB security risk & compliance reporting ā¶ SIEM & One ādashboardā to rule them all ā¶ IT Operations, application, server reboot, software license utilization monitoringā¦ OIL & GAS Drive Enterprise Insights! Splunk Security: Build an Enterprise Data Fabric from Security
- 51. Ā© 2017 SPLUNK INC. Demo: Connecting (Visualizing) Security for the Business [Splunk Enterprise Security Glass Tables]
- 52. Ā© 2017 SPLUNK INC. 1. Select the right sourcing strategy 2. Adopt an adaptive security architecture 3. Optimise threat intelligence management 4. Deploy advanced analytics 5. Proactive investigation & threat hunting 6. Promote security automation & human efficiency 7. Drive Enterprise āNot Justā Security Insights ā7 Enablersā of the Analytics Driven SOC
- 53. Ā© 2017 SPLUNK INC. Wrapping up
- 54. Ā© 2017 SPLUNK INC. Helping you build your analytics driven SOC Security Nerve Center
- 55. Next Step: Splunk Security Workshops SIEM+/SOC Readiness, Security Use Case Definition, Security Data Source Assessment, Security Automation, Security Business & Risk Visualisationā¦...... ā¢ Scope data sources, use cases and volumes ā¢ Security Analytics & SOC Building ā¢ Adding Machine Learning to SecOps ā¢ Learn how to visualize security success for the business ā¢ Data privacy & protection Contact your Splunk representative to find out how to schedule
- 56. Threat Activity Dashboard Splunk Quick Start for Security Analytics & SOC Rapidly Determine Advanced Malware and Threat Activity Malware Center Dashboard
- 57. Ā© 2017 SPLUNK INC. ā¢ 5,000+ IT and Business Professionals ā¢ 175+ Sessions ā¢ 80+ Customer Speakers PLUS Splunk University ā¢ Three days: Sept 23-25, 2017 ā¢ Get Splunk Certified for FREE! ā¢ Get CPE credits for CISSP, CAP, SSCP SEPT 25-28, 2017 Walter E. Washington Convention Center Washington, D.C. CONF.SPLUNK.COM .conf2017: The 8th Annual Splunk Conference
- 58. Ā© 2017 SPLUNK INC. Rate This Session on Pony Poll ponypoll.com/london17 Complete the survey for your chance to win a .conf2017 pass
- 59. Learn: How Travis Perkins built a SOC in the Cloud blogs.splunk.com Learn: Three Tips from Ciscoās CSIRT using Splunk isc2.org Try it yourself: Splunk Enterprise Security in our Sandbox with 50+ Data Sources splunk.com
- 60. Ā© 2017 SPLUNK INC. Helping you build your analytics driven SOC Security Nerve Center Thank You