1. 1 9/14/2010 Cloud Network Defense Tom Byrnes Founder & CEO 760.542.1550 x4242 tomb@threatstop.com www.threatstop.com Cloud Network Defense

2. 2 9/14/2010 Cloud Network Defense Network Forensics  RANUM: “the capture, recording, and analysis of network events in order to discover the source of security attacks or other problem incidents.”

3. 3 9/14/2010 Cloud Network Defense The “Fire”Wall

4. 4 9/14/2010 Cloud Network Defense Issues:  Time to detection.  Preservation and non repudiation of record.  Certainty of Actor.  Volume of data.  Often long after event.  Often not admissible in court (rw storage, chain of custody).  What machine had that IP AT THAT TIME?  Who was logged on?  Most irrelevant, alerts, etc.

5. 5 9/14/2010 Cloud Network Defense Threat List Management Sensors Users Firewall Standard DNS Lists Updated Every 2 Hours For Real Time Protection

6. 6 9/14/2010 Cloud Network Defense Filter, correlate, alert, in real time. The best event is one that didn’t happen. Block, alert, remediate. At the very least, alert. “We make your firewall better.” Source IPDestination IPDestination PortNumber of Attacks F00.42.151.18291.213.121.1766400972 F00.42.151.18288.198.88.1236400951 F00.42.151.10564.136.44.2120480599 F00.1.152.228207.46.179.24720480546 F00.42.6.28.12.43.25220480444 F00.42.151.18291.213.121.17620480344 F00.42.151.18291.213.121.17647873342 F00.42.151.40207.46.179.24720480310 F00.1.152.16366.150.14.11320480297 F00.42.151.664.236.85.14520480294 F00.42.151.168207.46.179.24747873282 F00.88.151.172208.89.13.13347873282 F00.88.151.17064.236.85.14520480280 F00.42.6.62174.129.239.3420480277 F00.42.151.129205.188.165.18520480221 F00.1.152.97207.46.179.24720480202 F00.42.152.1564.95.73.1320480188 F00.51.151.75216.223.0.20820480178 F00.42.152.788.12.43.25220480170 F00.88.151.20364.94.107.2220480154 F00.42.1.40168.75.65.9220480154 F00.77.151.16364.154.87.10820480153 F00.42.151.3064.236.85.14520480153 F00.1.151.10364.236.85.14520480152 F00.77.151.172.21.81.13320480148 F00.42.151.672.21.81.13320480147 F00.88.151.8566.54.16.4220480146 F00.88.153.5464.154.87.10820480139 F00.42.152.2964.236.85.14520480132 F00.1.152.15209.97.50.8020480129 F00.42.151.4207.46.179.24720480127 F00.42.151.13566.235.143.12120480125 F00.42.6.272.32.154.6220480125 F00.58.155.464.236.85.14520480115 F00.1.152.5266.150.117.3420480114 F00.1.151.102207.46.179.24720480114 F00.42.151.6209.97.50.8020480114 F00.42.151.16766.235.143.12120480110

7. 7 9/14/2010 Cloud Network Defense How it works

8. 8 9/14/2010 Cloud Network Defense Public tool

9. 9 9/14/2010 Cloud Network Defense Tom Byrnes Founder & CEO 760.542.1550 x4242 tomb@threatstop.com www.threatstop.com Cloud Network Defense