1. 2005 HR Retreat: Employment Teampriority-health.comSecurity Event Management February GR ISSA Meeting Security Event Management Correlation, Categorization, and Threat Modeling Paul.Melson@PriorityHealth.com

2. 2005 HR Retreat: Employment Teampriority-health.comSecurity Event ManagementFebruary GR ISSA Meeting SEM/SIM Security Event/Information Management Collect and analyze log & alert data from multiple sources Manage and modify event data within a single application Make pretty graphs & reports that impress the boss and mean something!

3. 2005 HR Retreat: Employment Teampriority-health.comSecurity Event ManagementFebruary GR ISSA Meeting Correlation Find commonalities between events from different data sources Quickly find and analyze the log trail of an attack Lay the foundation for finding patterns and anomalies in security data

4. 2005 HR Retreat: Employment Teampriority-health.comSecurity Event ManagementFebruary GR ISSA Meeting

5. 2005 HR Retreat: Employment Teampriority-health.comSecurity Event ManagementFebruary GR ISSA Meeting Correlation Practical application is straightforward –Firewall + IDS Correlation “Did that attack get through my firewall?” –Firewall + Server Correlation “Did that connection successfully authenticate?” –IDS + Monitoring Tools Correlation “Did that DoS attack take its target down?”

6. 2005 HR Retreat: Employment Teampriority-health.comSecurity Event ManagementFebruary GR ISSA Meeting Categorization Group similar event types from different sources Determine event outcomes such as success or failure Add “intelligence” to correlation Done primarily through parsing

7. 2005 HR Retreat: Employment Teampriority-health.comSecurity Event ManagementFebruary GR ISSA Meeting

8. 2005 HR Retreat: Employment Teampriority-health.comSecurity Event ManagementFebruary GR ISSA Meeting Categorization Practical application –Combine and manage events of similar type RealSecure + Snort = NIDS PIX + SonicWall = Firewall –Use outcomes and correlation to identify significant security events IDS attack + Firewall pass = Big Deal IDS attack + Firewall drop = No Big Deal

9. 2005 HR Retreat: Employment Teampriority-health.comSecurity Event ManagementFebruary GR ISSA Meeting Threat Modeling Additional data layer designed to provide higher degree of intelligence to event prioritization Typically asset-based (e.g. IP Address) Integrate network scanner results into the security event equation Good data requires lots of discovery and data entry

10. 2005 HR Retreat: Employment Teampriority-health.comSecurity Event ManagementFebruary GR ISSA Meeting

11. 2005 HR Retreat: Employment Teampriority-health.comSecurity Event ManagementFebruary GR ISSA Meeting Threat Modeling Practical Application –Use asset and vulnerability data to prioritize relevant events Web attack on web server = Medium Priority Attack on vulnerable server/port = High Priority –Note: This is only as useful as your asset data is accurate.

12. 2005 HR Retreat: Employment Teampriority-health.comSecurity Event ManagementFebruary GR ISSA Meeting Real Life Priority Health uses ArcSight v3 –Security event monitoring –Threshold and pattern based alerting –Case management & reporting –Compliance monitoring and log review NTP or some other form of time synchronization is critical to getting the most out of any SIM/SEM product.

13. 2005 HR Retreat: Employment Teampriority-health.comSecurity Event ManagementFebruary GR ISSA Meeting

14. 2005 HR Retreat: Employment Teampriority-health.comSecurity Event ManagementFebruary GR ISSA Meeting

15. 2005 HR Retreat: Employment Teampriority-health.comSecurity Event ManagementFebruary GR ISSA Meeting

16. 2005 HR Retreat: Employment Teampriority-health.comSecurity Event ManagementFebruary GR ISSA Meeting

17. 2005 HR Retreat: Employment Teampriority-health.comSecurity Event ManagementFebruary GR ISSA Meeting

18. 2005 HR Retreat: Employment Teampriority-health.comSecurity Event ManagementFebruary GR ISSA Meeting

19. 2005 HR Retreat: Employment Teampriority-health.comSecurity Event ManagementFebruary GR ISSA Meeting

20. 2005 HR Retreat: Employment Teampriority-health.comSecurity Event ManagementFebruary GR ISSA Meeting

21. 2005 HR Retreat: Employment Teampriority-health.comSecurity Event ManagementFebruary GR ISSA Meeting

22. 2005 HR Retreat: Employment Teampriority-health.comSecurity Event ManagementFebruary GR ISSA Meeting

23. 2005 HR Retreat: Employment Teampriority-health.comSecurity Event ManagementFebruary GR ISSA Meeting

24. 2005 HR Retreat: Employment Teampriority-health.comSecurity Event ManagementFebruary GR ISSA Meeting

25. 2005 HR Retreat: Employment Teampriority-health.comSecurity Event ManagementFebruary GR ISSA Meeting

26. 2005 HR Retreat: Employment Teampriority-health.comSecurity Event ManagementFebruary GR ISSA Meeting

27. 2005 HR Retreat: Employment Teampriority-health.comSecurity Event ManagementFebruary GR ISSA Meeting

28. 2005 HR Retreat: Employment Teampriority-health.comSecurity Event ManagementFebruary GR ISSA Meeting

29. 2005 HR Retreat: Employment Teampriority-health.comSecurity Event ManagementFebruary GR ISSA Meeting

30. 2005 HR Retreat: Employment Teampriority-health.comSecurity Event ManagementFebruary GR ISSA Meeting

31. 2005 HR Retreat: Employment Teampriority-health.comSecurity Event Management February GR ISSA Meeting Questions? Paul.Melson@PriorityHealth.com