SSLPrezentare RSA

CENTRALIZING INCIDENT
RESPONSE
RSA NetWitness
Brana Nikolajevic
Sales Specialist / Territory Manager
Threat Detection and Response
RSA NetWitness
COMPROMISE IS INEVITABLE
– Goal should be to detect and respond to attacks to minimize

loss and damage.
– Limit attacker free time inside your network.

WHAT TO DO ABOUT IT
Tools that provide visibility / forensic data are essential for detection
and response:
– Logs, Packets, Endpoint, Threat Inteligence

– Ability to spot anomalous / suspicious activity and investigate
– Ability to pivot and see the whole picture of the attack
– Ability to response timely
CENTRALIZING INCIDENT RESPONSE TEAMS
SOC:
Security Operation Center Better Detect,
CIRC: Investigate
Critical Incident Response Center
and Respond
CIRT:
Computer Incident Response Team to Security
CERT:
Incidents
Computer Emergency Response Team
SIRT:
Security Incident Response Team
SECURITY INCIDENTS GO UNNOTICED
Unnoticed Incidents Will Lead to Data Breaches
Lack of
85% of respondents
say there is no
75% of breaches
compromise systems
prioritization in days or less
Framework
and
Only 25% of breaches are
discovered
$5.4M is the cost
of a data breach
Alignment
in days or less in US
INDUSTRY VIEWPOINTS
• ESG - Security Incidents Unnoticed
– Too Many Non-Integrated Tools
– Too Many Manual Processes
– Lack of Staff
• Forrester – Effective Habits of Incident
Response
– Realistic Reporting & Metrics
– Scalable
– Collaborate
• Gartner – Detect & Respond to Security
Incidents
– CISOs need to put in place incident response
process with technology
WHY FRAMEWORK AND ALIGNMENT?
IMPROVE RESPONSE
READINESS AND BE COLLABORATE INTERNALLY
PREPARED AND EXTERNALLY
REPEATABLE ONGOING
BUSINESS PROCESS LEARN AND REFINE
MEASURE EFFECTIVENESS PRIORITIZE AGAINST

OF THE PROGRAM BUSINESS CONTEXT
RSA NETWITNESS
Capture, enrich and analyze data from across your network
Visibility Analysis Action
PACKETS LIVE LIVE
Capture Time
Data Enrichment
LIVE Incident Compliance
LOGS Management Reporting
Cloud
ENDPOINT ENRICH Session

On Investigation
Reconstruction
Prem
NETFLOW
Advanced Endpoint Analysis

Analytics
Threat Intel | Biz Context Rules | Parsers | DS Models Reports | Feeds

RSA LIVE
Powered by RSA Research, Incident Response & Engineering
VOICE OF THE CUSTOMER
“We switched on Security Analytics (NetWitness) and a lot

of things suddenly started lighting up, just like a Christmas
tree.”
Jason Haward-Grau, MOL Group CISO

COMPROMISE IS INEVITABLE
– Goal should be to detect and respond to attacks to minimize

loss and damage
– Limit attacker free time inside your network

WHAT TO DO ABOUT IT
Tools that provide visibility / forensic data are essential for detection
and response
– Logs, Packets, Endpoint, Threat Inteligence

– Ability to spot anomalous / suspicious activity and investigate
– Ability to pivot and see the whole picture of the attack
CAPTURE TIME DATA ENRICHMENT
 Enriches data right at time of capture making it much
LIVE
Capture Time faster and more valuable for analysis and investigation
Data Enrichment – Seconds to respond in a time of crisis
 Inspect every network session, log event, and flow for

threat indicators
ENRICH  Most robust meta data (over 200)
– Enables rapid alerting and investigations
– Session based details to lead the analyst to the right answer
 Fastest Retrieval & Reconstruction

Parsing and – Maintains the link between the sessionized data and the raw
Metadata Tagging
Add’l Context data
 Virtual, Physical and/or SW
RSA NETWITNESS SECOPS
Framework &
Alignment
RSA NetWitness SecOps provides a framework

to prepare, investigate and respond to threats
by aligning people, process and technology.
LEVERAGE BEST PRACTICES
NAMING & RESPONSE PRACTITIONER

TERMINOLOGY PROCESS VIEW
25+
CIRC
VERIS
Framework
ENGINEERED AS PER THE EXPERTISE OF INDUSTRY AND

PRACTITIONERS
RSA NETWITNESS SECOPS
Domain
Process
People Technology
Framework &
Alignment
RSA NW SecOps
Incident Breach SOC Prog.

Response Response Management
RSA NW SECOPS KEY VALUE FUNCTIONS
Incident Breach SOC

Response Response Program Management
✓ Aggregate Alerts ✓ Develop Breach Response Plans ✓ Manage SOC Team

✓ Provide Business ✓ Identify & Report Data Breaches ✓ Measure Security Control Effectiveness
Context ✓ Assess Breach Impact ✓ Document Response Policies &
✓ Prioritize Incidents ✓ Manage Notifications & Call
Procedures
✓ Manage Investigations Trees ✓ Link with Business GRC Applications
✓ Track Remediation
RSA NW SECOPS IR WORKFLOW
Launch Security Tool in-context for investigation…
Collect Data
for Context
Forensic Corporate
Triage
Analysis Compliance
Alerts Incidents Investigations

(Automated or Manual) Regulatory
Security Monitoring Business Legal

Tools
Confirmed Data Yes
Exfiltrated? Impact Analysis
Close Incidents
Yes No No
Data/Privacy Breach
Containment Remediation
External/Internal
Notifications
Close
PREPARING FOR A DATA BREACH
Make breach preparedness a priority

Identify
Stakeholders ▪ Typical cost of a data breach in US is
$5.4M1
Notification Classify Data Put in place a structure for response,
History Breaches
reporting and process
▪ Focus breach response teams by defining
owners, steps, timelines & call trees
Notifications Breach Risk
and Call Trees Assessment
1. 2013 Cost of Data Breach Study: Ponemon Institute

INTEGRATIONS WITH RSA NW SECOPS
RE CEF, TCP/STCP
NetWitness ESA CEF, TCP
OOTB
SAIM JSON, RMQ
▪ RSA tested
▪ Mapping file details provided to map incoming SIEM
CEF, TCP data to Archer fields
Non-OOTB (Other Integrations)

CEF, TCP ▪ PS capable – Integrated in field
− Mapping file details will need to be created
▪ Unified Collector Framework (UCF) supports

CEF, UDP − Format
• Syslog CEF messages or JSON
− Transport
JSON,
TCP/STCP • UDP, TCP, Secured TCP
• RabbitMQ SSL
RSA ADVANCED CYBER DEFENSE
SERVICES
 Incident Response
Rapid breach response & SLA-
based retainer
 Strategy & Roadmap
Review and recommendations
 NextGen Security Operations
Technical consulting to transform
from reactive to proactive
RSA ADVANCED CYBER DEFENSE
SERVICES
Develop and mature a portfolio for ongoing competitive advantage
Incident Response
Retainer | Incident Discovery | Incident Response | IR Hunting Services
Breach Management
ASOC Design & Implementation

ASOC Strategy, Design & Program Development
Technology & Operations Buildout | Residencies, Support & Training
Security Operations Management

SecOps Strategy & Management | Use Case Development
Incident Response Procedures
Cyber & Counter Threat Intelligence

Program Development | Web & E-mail Threat Operations | Best Practices
Cyber Readiness & Capability Roadmap

Current State & Gap Analysis | Maturity Modeling | Breach Readiness Roadmap |
Net Defender (Cyber Security Framework)
TITLE
A SIMPLE WAY TO ADD THE NEW
TEMPLATE TO YOUR PRESENTATION
1. Open your presentation > select Slide Sorter view >

Select all > Copy 2. Open the file RSATemplateAug2016.potx > select Slide Sorter view
3. Place your cursor after the sample slides, then Paste. Your slides will 4. Delete any unused master slides. Save your
take on the master of the preceding slide. Adjust any slides which did new file.
not convert by clicking on Layout and choosing the right layout.

SSLPrezentare RSA

Uploaded by

Copyright:

Available Formats

SSLPrezentare RSA

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

SSLPrezentare RSA

Uploaded by

Copyright:

Available Formats

CENTRALIZING INCIDENT

– Goal should be to detect and respond to attacks to minimize

– Limit attacker free time inside your network.

– Logs, Packets, Endpoint, Threat Inteligence

MEASURE EFFECTIVENESS PRIORITIZE AGAINST

ENDPOINT ENRICH Session

Advanced Endpoint Analysis

Threat Intel | Biz Context Rules | Parsers | DS Models Reports | Feeds

“We switched on Security Analytics (NetWitness) and a lot

Jason Haward-Grau, MOL Group CISO

– Goal should be to detect and respond to attacks to minimize

– Limit attacker free time inside your network

– Logs, Packets, Endpoint, Threat Inteligence

 Inspect every network session, log event, and flow for

 Fastest Retrieval & Reconstruction

RSA NetWitness SecOps provides a framework

NAMING & RESPONSE PRACTITIONER

ENGINEERED AS PER THE EXPERTISE OF INDUSTRY AND

Incident Breach SOC Prog.

Incident Breach SOC

✓ Aggregate Alerts ✓ Develop Breach Response Plans ✓ Manage SOC Team

Alerts Incidents Investigations

Security Monitoring Business Legal

Make breach preparedness a priority

1. 2013 Cost of Data Breach Study: Ponemon Institute

Non-OOTB (Other Integrations)

▪ Unified Collector Framework (UCF) supports

ASOC Design & Implementation

Security Operations Management

Cyber & Counter Threat Intelligence

Cyber Readiness & Capability Roadmap

1. Open your presentation > select Slide Sorter view >

You might also like