Introduction to a Security Intelligence Maturity Model

Damaging Data Breaches 80 Million Accounts Stolen 56 Million Credit Cards Stolen 83 Million Accounts Exposed 145 Million Accounts Compromised 40 Million Credit Cards Stolen Talking Points - Examples: Anthem: Criminals accessed names, birthdays, email addresses, SS#s, addresses, and employment data (including income). This is highly valuable data that can be sold on the black market to enable identity theft. Home Depot: Credit/Debit cards and email addresses that can be sold on the black market for credit card abuse JP Morgan: Theft of email addresses, home addresses, and phone numbers which can be sold on the black market to enable fraud Ebay: Theft of names, email addresses, home addresses, phone numbers and date of birth Target: Credit card data to be sold on the black market

Prevention-centric is Obsolete “Advanced targeted attacks make prevention-centric strategies obsolete. Securing enterprises in 2020 will require a shift to information and people-centric security strategies, combined with pervasive internal monitoring and sharing of security intelligence.” “By 2020, 60% of enterprise information security budgets will be allocated for rapid detection and response approaches up from less than 10% in 2013.” - Neil MacDonald, Talking Points The industry is shifting from a focus on prevention to a more rounded approach including ability to detect and respond Assumption is that hackers will get in – must be able to recognize early compromises and take action

Today’s Threat Environment ! Threats conclusively recognized at run-time, prevented at the endpoint and perimeter. Only Analytics can detect these threats However, many threats: ! Detecting a class of threats only a Big Data approach can realize Effectively prioritizing threats, separating the signal from the noise Providing the intelligence required to deliver optimally orchestrated and enabled incident response 2 Require a broader view to recognize 1 Get lost in the noise ! 3 Will only emerge over time !

A Security Intelligence Driven Approach is Required The cost of mitigating a threat, and risk to the business, rise exponentially across the lifecycle of a threat from inception to mission attainment.   “By 2020, 60% of enterprise information security budgets will be allocated for rapid detection and response approaches, up from less than 10% in 2013.” Reconnaissance Initial Compromise Command & Control Lateral Movement Target Attainment Exfiltration / Corruption / Disruption User Endpoint Network Organizations that desire to reduce their risk of experiencing a high impact cyber breach or incident must kill the threat early in it’s lifecycle, across the holistic attack surface.   Key Talking Points: “Holistic attack surface” Mission realization Kill the threat easily Previous breaches would’ve been avoided if detected early. ----- Notes: Goes further on our solution to show that damaging breaches can be avoided because the threat lifecycle takes time. The lifecycle of a threat begins with reconnaissance. Find their way in by manipulating users, dropping USB keys in parking lot, compromising physical environment, etc. At some point, they will begin to engage with the environment and eventually compromise the system. If that compromise isn’t detected, they will take increasing control over the environment and move laterally toward their target, taking over accounts and systems until they attain their target, where the biggest damage is done: exfiltration, corruption, disruption, etc. This is how threats work. If we can stop the attacker after the initial compromise, we can prevent the damaging breach.

Security Intelligence Defined Security Intelligence is the ability to capture, correlate, visualize, and analyze forensic data in order to develop actionable insight to detect and mitigate threats that pose real harm to the organization, and to build a more proactive defense for the future. Greater levels of Security Intelligence will enable adopters to shorten their Mean-Time-to-Detect (MTTD) and Mean-Time-to-Respond (MTTR), extend the value of current security tools, and discover previously unseen threats through advanced machine analytics

Security Intelligence Measured Key Talking Points: “Mean-time-to-detect” and “Mean-time-to-response” Reduce risk of damaging cyber incident or data breach ----- Notes: What’s the solution? Faster detection and faster response. We’ve developed a model to assess your current maturity and ability to detect and respond to threats. Help customers measure their overall security posture. Many studies show that MTTD and MTTR are measured in weeks and months, and companies that want to improve need the types of solutions we provide.

Market Drivers for a Maturity Model There is an increasing rate and growing sophistication of cyber threats This is leading to an increased awareness of the severity of cyber threats A fundamental shift is beginning to take place in terms of the overall approach enterprises now have toward delivering cyber security to the organization Security Monitoring and Security Intelligence are still not well defined A clear definition and maturity model provides organizations with a road map of how to orchestrate this shift to achieve organizational security goals

Organizational Risk Characteristics

Security Intelligence Investments & Capabilities

Level 0 Details

Level 1 Details

Level 2 Details

Level 3 Details

Level 4 Details

Maturity Level Progression LogRhythm’s Security Intelligence Maturity Model provides the framework for organizations to assess and evolve their Security Intelligence capabilities Key Talking Points: Cybersecurity is a journey, not a destination Maturity model provides roadmap LogRhythm is your partner for long-term success. ----- Notes: What is your security intelligence posture? This slide introduces our SIEM model. Drive consultative conversation. Tell about the model. It is designed to provide a roadmap to help customers improve their security over time. Our comprehensive platform approach and services can you help you mature your capabilities over time. We are their partners on this journey.

Key Takeaways Today’s threat landscape transcends yesterday’s defense-in-depth framework It’s When, not If a breach will occur Improved detection and response capabilities are essential Understand “normal” across multiple dimensions and monitor for “abnormal” Employ advanced security analytics to optimize breach detection & response and reduce risk