Security Operations Without Going Blind Greg Taylor-Broun, Product Strategist

Challenge #1 Majority of analysts don’t enjoy continuous security monitoring nor do they rate is as particularly valuable to their primary objective Voice of the Analyst Survey, Cyentia Institute

Challenge #2 Hiring and retaining analysts

Challenge #3 We’ll never be able to look at everything with human analysis Telemetry IDS/IPS, AV, Web Proxy, EDR Pattern-matching Log Platform Collectors, Forwarders and DB Aggregation, Filtering & Storage Rules, Queries & ML SIEM, UEBA, ML Correlation & Anomalies Consoles & Dashboards Human Analytics Human Security Monitoring

Security Analyst role Investigate Threat Prioritize & Escalate Receive feedback & improve Operational Duties Scope & Build Case Environmental Awareness Foundational Knowledge Security Expertise

You’re the Analyst How would you analyze this Network IPS event? 192.168.0.1:60036 -> 192.168.4.10:443, SQL Injection, 6Aug16, 20:08:03, Exploitation, Permit, Medium

You’re the Analyst How would you analyze this Network IPS event? Source Port Ephemeral? Destination Port Server Port? Attack Category Which attack stage? Severity How severe? 192.168.0.1:60036 -> 192.168.4.10:443, SQL Injection, 6Aug16, 20:08:03, Exploitation, Permit, Medium Source IP Ext or Int? Tor Exit Node? Public VPN? Country of Origin? Is an IOC? Destination IP Vulnerable? Port open? Change ticket? Critical Asset? Signature Modern? Recently updated? Seen in an incident? False positive? Date and Time Suspicious Pattern? False positive pattern? Device Action Blocked? Allowed? Now do this 170 times an hour in a 10-12 hour shift!!

Modeling Human Decision Making Expert system and Bayesian Network

Rule Logic vs. Probabilistic Reasoning Probability theory is nothing but common sense reduced to calculation. Pierre-Simon Laplace

Security Operations Center Respond Software AI Expert System Strategy & Approach We’re moving to a new model for security monitoring and analysis Security Operations Center Business Focused Analytics 8x5 Operations Incident Response Hunting & Investigation Business Focused Use Cases & Respond Software AI Expert System 24/7 Monitoring, Scoping & Escalation Complete Visibility of Core Use Cases Business Context Local and Global Learning Elevate your analysts

Questions