1. Why SIEM – Why Security Intelligence??
Presented by:
Curtis Johnson
LogRhythm Sales Engineer
Sponsored by:

2. The Expanding Cyber Threat Motive
Political
Ideological
Criminal
Examples
Political: Allegedly, North Korea is responsible for the mass data theft of Sony Entertainment as a pay back for releasing the movie, “The Interview”
Ideological: The Syrian Electronic Army is responsible for a number of website defacements, including in Jan 2015 SEA hackers managed to infiltrate LeMonde’s publishing tool before launching a denial of service
Criminal: A cyberattack exposed 11 million Premera Blue Cross members data to sell the IDs on the blackmarket and enable identity thefts

3. Damaging Data Breaches
80 Million
Accounts Stolen
56 Million
Credit Cards Stolen
83 Million
Accounts Exposed
145 Million
Accounts Compromised
40 Million
Credit Cards Stolen
Examples:
Anthem: Criminals accessed names, birthdays, addresses, SS#s, addresses, and employment data (including income). This is highly valuable data that can be sold on the black market to enable identity theft.
Home Depot: Credit/Debit cards and addresses that can be sold on the black market for credit card abuse
JP Morgan: Theft of addresses, home addresses, and phone numbers which can be sold on the black market to enable fraud
Ebay: Theft of names, addresses, home addresses, phone numbers and date of birth
Target: Credit card data to be sold on the black market

4. Most Companies Compromised
“71%
of organizations were compromised by a successful cyber attack in 2014.”
2015 Cyberthreat Defense Report from CyberEdge Group as reported by SC Magazine 3/12/2015
IT’s WHEN, NOT IF…!
Notes:
Most companies have had some form of a compromise in the past year – it’s not just big companies. Almost 3 out of 4 companies were compromised by a successful compromise. Some avoided data breach by detecting the compromise – but some didn’t.

5. Prevention is Futile
“Advanced targeted attacks make prevention-centric strategies obsolete. Securing enterprises in 2020 will require a shift to information and
people-centric security strategies, combined with pervasive internal monitoring and sharing of security intelligence.”
“By 2020, 60% of enterprise information security budgets will be allocated
for rapid detection and response approaches up from less than 10% in 2013.” Neil MacDonald

6. Faster Detection & Response Reduces Risk
229 median number of days that threat groups were present on a victim’s network before detection
Mandiant 2014 Threat Report
2,287 Days was the longest time to detection observed.
Mandiant 2014 Threat Report
IN 60% OF CASES,
ATTACKERS ARE ABLE
TO COMPROMISE AN
ORGANIZATION
WITHIN MINUTES.
2015 Verizon Data Breach Report
As organizations improve their ability to quickly detect and respond to threats, the risk of experiencing a high impact breach is greatly reduced.
RISK & IMPACT OF BREACH

7. Ever Increasing Cyber Risk
ADVANCED THREAT / APT DETECTION
DATA EXFILTRATION
COMPROMISED HOSTS
INAPPROPRIATE NETWORK USE
FRAUD
INSIDER THREATS
COMPROMISED ACCOUNTS
COMPROMISED HOSTS
COMPROMISED CREDENTIALS
NETWORK MISUSE
COMPLIANCE VIOLATIONS
STATE-SPONSORED ATTACKS
Source: PwC, The Global State of Information Security Survey 2015

8. Today’s Threat Environment
Only Advanced Analytics can detect these threats
Threats conclusively recognized at run-time, prevented at the endpoint and perimeter
Detecting a class of threats only a Big Data approach can realize
Effectively prioritizing threats, separating the signal from the noise
Providing the intelligence required to deliver optimally orchestrated and enabled incident response
However, many threats:
Require a broader view to recognize
Will only emerge over time
Get lost in the noise

9. A Security Intelligence Driven Approach is Required
The cost of mitigating a threat, and risk to the business, rise exponentially across the lifecycle of a threat from inception to mission attainment.
• Exfiltration
• Corruption
• Disruption
Attack
Reconnaissance
Initial
Compromise
Command
& Control
Lateral
Movement
Target
Attainment
Organizations that desire to reduce their risk of experiencing a high impact cyber breach or incident must kill the threat early in it’s lifecycle, across the holistic attack surface.

10. Holistic Attack Surface
Network
Endpoint
Network
User
User
Network
User
User
Endpoint
Endpoint
Network
User
Endpoint
User
Holistic Attack Surface
User
User
Network
Network
User
Endpoint
Endpoint
User
User
Endpoint
Network
User
Network
User
Network

11. Threat Lifecycle Management™: End-to-End Detection & Response Workflow
UNIFIED SECURITY INTELLIGENCE PLATFORM
TIME TO DETECT
TIME TO RESPOND
FORENSIC
DATA
Security
Event Data
Captured Log &
Machine Data
Generated Forensic Sensor Data
DISCOVER
User Analytics
Machine Analytics
QUALIFY
Assess threat and determine if it may pose risk and whether a full investigation is required.
INVESTIGATE
Fully analyze the threat and associated risk, determine if an incident has or is occurring.
MITIGATE
Implement countermeasures and controls that mitigate risk presented by the threat.
RECOVER
Eradicate Cleanup
Report
Review
Adapt

12. Creating A Security Eco System
Businesses have been buying these Solutions For Years…..
SIEM -Makes These Pieces Work As A Single Security Eco System…
SIEM
Security
Firewall
IPS
Malware
WAF
End Point
Network
Routers
Switches
Wireless
Directory Services
Active Directory
Users
Groups
Data Management
Data Loss
Data in Motion
Data at Rest
Spam
Phishing
Physical
Alarms
Surveillance
Access Control

13. LogRhythm Security Intelligence Maturity Model Progression
Level
Description
BLIND
No Visibility 1
MINIMALLY COMPLIANT
Check Box 2
SECURELY COMPLIANT
Holistic View
Breaking log Silos
Machine Analytics 3
VIGILANT
Host data collection
3rd party feeds
Packet captures
Automated response 4
RESILIENT
Forward looking
24x7 SOC
LEVEL 0
LEVEL 1
LEVEL 2
LEVEL 3
LEVEL 4

14. Thank You! Any questions?
Download the Security Intelligence Maturity Model whitepapers at:
Sponsored by: