1. Security Automation Standards Landscape

2. The Evolution of a Security Event Ecosystem
SEM
Security Event Management
Real time event detection and classification
SIEM
Security Information & Event Management
Merger of SEM and SIM tools and their data stores
Proactive Defense
Real time use of event data to reconfigure defenses to stop attacks as they occur
Unorganized Data
from
Syslog, Firewall & IDS logs, etc.
Self Healing Ecosystem
for
Networks, Devices and Data
2014
SIM
Security Information Management
Stored data analysis for forensics, trend data, and compliance evidence
Data Analytics
Situational awareness provided by advanced source ingestion, data correlation and analysis
Security Automation
Standard protocols and content repositories merge network and device detection and remediation
Contact Frequency
Probability of Action

3. Automating Event Management
2) Protect
Standardize and enforce device configuration, policies
1) Identify
Standardize and enforce device configuration, policies
3) Detect
Continuously monitor for unapproved accidental or malicious changes
4) Respond
Affected or observant devices report to community, operations centers, etc.
5) Recover
Alerts automatically restore device. New threats automatically enhance configuration
Common configuration & event repository

4. Ongoing Industry & Standard Support
2) Protect
NIST-MITRE: SCAP
NIST: CAESAR-FE
IETF: SACM
Open Group: ACEML
Identify
NIST-MITRE: SCAP
NIST: CAESAR-FE
IETF: NEA, SACM
Open Group: ACEML
3) Detect
TCG: TPM, MTM
4) Respond
IETF: IODEF, RID, MILE
Open Group: XDAS
MITRE: STIX, TAXII
Common configuration & event repository
Trusted Computing Group:
IF-MAP
User-Advisors:
Boeing, CMU, DHS, DoD, MITRE, NASA, NIST, NSA
Vendor Participation:
Avaya, Chinamobile, Cisco, EMC, HP ArcSight, IBM, Juniper, nCircle, McAfee, Qualys, ThreatGuard, Tripwire
5) Recover
IETF: NEA, SACM

5. Standards Gaps: Security Automation
Whitepaper framing customer pain points & problems, requirements
Over-arching framework or architecture describing all relevant standards and interoperability
Multi vendor interoperable solutions
Other gaps?

6. Vision for Future State: Security Automation
14 September, 2018
Vision for Future State: Security Automation
Use behind healthcare forum discussion, las 2 questions
Copyright © The Open Group 2012

7. Security Automation Summary
Benefits
Challenges
Accurate and timely situational awareness
Support for informed decision-making
Share information with other defenders
Enable automated or facilitate manual responses
Automated responses can be used against you
Security automation is new technology
Defenders relying on automation can become complacent
Sophisticated attacks can go unnoticed

8. Food for Thought:
Is there a need to rationalize or connect security automation in enterprise security architectures?
Today we may have manually-oriented functions (event management, incident response, patching) described in our enterprise security architecture
Going forward, Automated Security responses could be designed in…
Is there a need to connect security automation to risk management?
Risk analysis could help pinpoint where assets at risk need mitigating controls