INTRODUCTION Sam Wachira Director and CTO at Kenindus Limited . Holds a Bachelor of Science degree in Computer Information Management from Life University in Atlanta, Georgia and a Masters in Small Business and Entrepreneurship from Plymouth State in Plymouth, New Hampshire. I have more than 10 years experience in cyber security software engineering. Some of the notable organizations I have worked for include BAE Systems, Rapid 7 and 3M. At BAE Systems I worked with NetReveal and Vuma, at Rapid 7 I worked with Nexpose and Metasploit, Software that have received international accolades and adopted by both small and big financial institutions, government agencies and other private entities setting a standard by which others are measured.

Phoenix – Guard SIEM What’s a SIEM ? Security Information and Event Management (SIEM) is about looking at your network through a larger lens than can be provided by a single security control or information source. For example: Your Asset Management system only sees applications, business processes and administrative contacts. Your Network Intrusion Detection system (IDS) only understands Packets, Protocols and IP Addresses Your Endpoint Security system only sees files, usernames and hosts Your Service Logs show user sessions, transactions in databases and configuration changes. File Integrity Monitoring (FIM) systems only sees changes in files and registry settings

How a SIEM Works

Phoenix – Guard SIEM LMS - “Log Management System SLM /SEM– “Security Log/Event Management LMS - “Log Management System” – a system that collects and store Log Files (from Operating Systems, Applications) from multiple hosts and systems into a single location, allowing centralized access to logs instead of accessing them from each system individually. SLM /SEM– “Security Log/Event Management” – an LMS, but marketed towards security analysts instead of system administrators. SEM is about highlighting log entries as more significant to security than others.

Phoenix – Guard SIEM SIM – “Security Information Management SEC - “Security Event Correlation SIM – “Security Information Management” - an Asset Management system, but with features to incorporate security information too. Hosts may have vulnerability reports listed in their summaries, Intrusion Detection and AntiVirus alerts may be shown mapped to the systems involved. SEC - “Security Event Correlation” – To a particular piece of software, three failed login attempts to the same user account from three different clients, are just three lines in their log file. To an analyst, that is a peculiar sequence of events worthy of investigation, and Log Correlation (looking for patterns in log files) is a way to raise alerts when these things happen.

Phoenix – Guard SIEM Features In Phoenix Phoenix features are extensive to secure each unique environment: Comprehensive logging of activity for offline analysis and forensics. Port-independent analysis of application-layer protocols. Support for many application-layer protocols (including DNS, FTP, HTTP, IRC, SMTP, SSH, SSL, SMB). Analysis of file content exchanged over application-layer protocols, including MD5/SHA1 computation for fingerprinting. Tunnel detection and analysis (including Ayiya, Teredo, GTPv1). Phoenix decapsulates the tunnels and then proceeds to analyze their content as if no tunnel was in place. Vulnerability assessment

Phoenix – Guard SIEM Features In Phoenix Extensive sanity checks during protocol analysis. Support for IDS-style pattern matching. Network Intrusion Detection System (NIDS) engine Network Intrusion Prevention System (NIPS) engine Network Security Monitoring (NSM) engine Off line analysis of PCAP files Full system Audit DOS detection Auto discovery Scan Penetration testing Identifies vulnerabilities that allow a remote attacker to access sensitive information from the system Network Monitoring intrusion detection system (IDS)  Web Audit

The cost of cyber crime impacts all industries. The average annualized cost of cyber crime varies by industry sector. In this year’s study, we compare cost averages for 17 different industry sectors. As shown in the figure below, the cost of cyber crime for companies in financial services and utilities & energy experienced the highest annualized costs. In contrast, companies in hospitality, automotive and agriculture sectors incurred a much lower cost on average

Types of cyber attacks experienced by companies

Average annualized cyber crime cost weighted by attack frequency

Percentage use of five advanced SIEM features

P h o e n i x – G u a r d

THANK YOU