Infection and exploits will occur. The new goal is to prevent those infections from becoming a data breach. To do this successfully, security analysts need the ability to continuously collect, analyze, correlate and investigate a diverse set of data. Our security expert will discuss the specific data sources and capabilities required to determine the scope of an infection before it turns into a breach. You will also see a live incident investigation that demonstrates this approach.
3. 3
Source: Mandiant M-Trends Report 2012/2013/2014
67%
Victims notified
by an external
entity
100%
Valid credentials
were used
229
Median # of
days before
detection
The Ever-Changing Threat Landscape
4. 4
Single Platform for Security Intelligence
SECURITY &
COMPLIANCE
REPORTING
REAL-TIME
MONITORING
OF KNOWN
THREATS
DETECT
UNKNOWN
THREATS
INCIDENT
INVESTIGATIONS
& FORENSICS
FRAUD
DETECTION
INSIDER
THREAT
Splunk Complements, Replaces and Goes Beyond Existing SIEMs
13. Adversary Perspective—Attack Kill Chain
Discovery
Weaponization
Delivery
Exploitation
Installation
Command and
Control (C2)
Actions on
Objectives
Lockheed Martin white paper: Intelligence-Driven Computer Network Defense of Analysis of Adversary Campaigns and Intrusion Kill Chains
15. 15
Kill Chain—Breach Example
http (web) session to
command & control
server
Remote control
Steal data
Persist in company
Rent as botnet
WEB
Delivery Exploitation Installation C2 Actions on Objectives
.pdf
.pdf executes & unpacks malware
overwriting and running “allowed” programs
Svchost.exeCalc.exe
Attacker creates
malware, embed in .pdf,
emails
to the target
MAIL
Read email, open attachment
Threat Intelligence
Access/Identity
Endpoint
Network
18. Demo Review
Challenges
– Difficult to go from threat-intel match to root cause
– Hard to determine – was there a breach?
Sources
– Threat intel – open source threat intel feed
– Network – web proxy logs, email logs
– Endpoint – endpoint monitoring agent
– Access/identity – asset management database
Finding the root cause: connecting the dots
– Match the threat-intel IP to network data to identify the infected machine
– Identify the malicious process by mapping network data to endpoint data
– Discover the infected email by matching local file access to email data
19. Best Practices—Breach Response Posture
Bring in data from at least one from each category:
– Network – next gen firewall or web proxy, email, DNS
– Endpoint – Windows logs, registry changes, file changes
– Threat intelligence – open source or subscription based
– Access and identity – authentication events, machine-user mapping
Establish a security intelligence platform so analysts can:
– Contextualize events, analytics and alerts
– Automate analysis and exploration
– Share techniques and results to learn and improve
There are three numbers in the cyber security statistics are very telling, and we should pay close attention to:
100% of breaches are done using valid credentials;
And it still takes average 229 days to detect a breach;
With all security technologies deployed in the enterprises, there are still 67% of , which represents 2 out 3, breaches are first reported to the enterprise by a 3rd parties (FBI, SS)
Splunk is a Security Intelligence Platform and we can address a number of security use cases. We’re more flexible than a SIEM and can be used for non-security use cases. Splunk software can complement or replace existing SIEM deployments, while also addressing more complex security use cases, such as supporting fraud detection and finding insider threats.
You want visibility where the adversary manifests itself. Imagine a malicious email that gives delivered. what are the places you can detect it ? And respond to the breach ?
Network – network based attack, lateral movement, exfiltration
Endpoint – malware exploitation – data gathering, launch point
Authentication – the basis of lateral movement and access to assets, intellectual property
Threat intel – External context to be fused with all these data sources, in advance of the attack or post breach
You derive this rationale from the activity in your in your environment. Fusing it with the knowledge of those who have broader vantage points. And then contextualizing it with business information. Lets talk about each of these. Many of you in this room have told us that this is what works. And indeed, this has been my own experience. Before I came to splunk, I was a splunk customer…. And this strategy works… Lets dive into this…
The capabilities required to distinguish an infection from a breach
Why is it important to preserve an event?
Risk Based Analytics to Align Security Operations With the Business
Risk scoring framework enhances decision making by applying risk score to any data
Quickly and easily assign any KSI or KPI to any event to produce risk scores
Expose the contributing factors of a risk score for deeper insights
Visualize and Discover Relationships for Faster Detection and Investigation
Visually fuse data, context and threat-intel across the stack and time to discern any context
Pre-built correlations, alerts and dashboards for detection, investigation and compliance
Workflow actions and automated lookups enhance context building
Enrich Security Analysis with Threat Intelligence
Automatically apply threat intelligence from any number of providers
Apply threat intelligence to event data as well as wire data
Conduct historical analysis using new threat intelligence across all data
The adversary’s success lies in a deliberate methodology.
Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains
Exploitation != Gameover when you have analysts that can use the analytics ability and contextualize it
Use the animation to talk to the Zeus attack scenario described in the Zeus demo.
Reconn – find vulnerability, find method most likely to gain access – locate vulnerable server with .pdf
Reconn - Attacker attacks an extranet portal (vulnerable server) and steals a known good document (.pdf)
Weaponization - Attacker creates malware and packages up in pdf and names it the same document as that on the portal (look like a good document)
Delivery - Attacker spoofs (use technique to send email that looks like it’s coming from an employee of the company) a company employee email and sends to several targets at the company
Exploitation – User (all it takes is one) reads email, open the attachment, exploits a vulnerable in a document reader that allows programs to run
Installation – program installs several programs that over-write “good” programs on the computer – the calculator program – calc.exe
Installation – calc.exe spans svchost.exe, a generic program on windows machines
Command and Control – svchost.exe establishes communication to remote command and control server.
Point out – this came from a real example. The left shows the different defensive technologies that might have seen something.
Contextualization and exploration is automatic – you saw this in the field discovery menu
Raw events without modification or changes – so you can auto-extract and search adhoc and tie things together as you see fit
Nothing to join
Create a search
Over 2500 security/compliance customers worldwide. Customers cover all sizes and verticals, and are all over the world. While not listed here, hundreds of SMBs and individuals also use for security/compliance.
We are humbled by your trust. You have confirmed to us that in partnering with you – our customers we deliver a world class security intelligence platform.
Thank you!
Before we jump into questions. Some important .conf announcements…
Splunk has an active community:
There is an emerging ecosystem of new companies building apps on top of Splunk. They are taking advantage of open APIs and new platform capabilities to create an entirely new generation of applications.
Splunk Answers is the go-to place for your questions – and answers. Our technical support is consistently rated as industry leading and Splunk Answers has answers to thousands of questions.
You can participate in meet-ups and User Groups, contribute to our forums, or attend local SplunkLive events (like this one) to hear from you peers.