achieving 360° view of security for complete situational awareness

Achieving 360° view of security for complete situational awareness

Haymarket Hotel

Sli.do event code: 151015WiFi Password: picture

Agenda

- Welcome – Isaac George, SVP and Regional Head, Happiest Minds

- Getting to Grips With Cyber-Security - Bob Tarzey, Analyst and Director, Quocirca

- Cyber-Security of Tomorrow – Michiel Benda, Group CISO, TMF Group

- Achieving 360° View of Security for Situation Awareness and Integrated Security Management - Prasenjit Saha, CEO Infrastructure and Security Services Business, Happiest Minds

- Q&A panelSli.do event code: 151015

quocircaClarifying the business impact of technology

Getting to grips with cyber-securityOct 15th 2015

Bob Tarzey

Analyst and Director

Quocirca Ltd

© Quocirca 2015quoc

irca–

Clar

ifyin

g th

e bu

sine

ss im

pact

of t

echn

olog

y

Themes

The growing worry about IT security

The threat actors

How might you be hit?

Why might you be targeted?

The UK cybercrime scene

Effective measures

Working with MSSPs


irca–

Clar

ifyin

g th

e bu

sine

ss im

pact

of t

echn

olog

yChanging IT management concerns – 2013 to 2015

0.38

1.23

0.82

1.27

1.33

1.91

1.26

1.20

1.62

1.91

2.07

0.67

0.81

0.99

1.00

1.33

1.36

1.39

1.46

1.49

1.93

2.58

0 1 2 3

Inflexible IT monitoring

Underutilised hardware

Poor customer experience

Regulatory fines

Our innovation to slow

Overpriced software

Over-invesment

Data chaos

Keeping up with innovation

Down time

Security

2015

2013

Source – Quocirca 2015

Masters of Machines II


irca–

Clar

ifyin

g th

e bu

sine

ss im

pact

of t

echn

olog

y

-0.55

-0.42

-0.27

0.17

0.26

0.29

0.51

-0.6 -0.4 -0.2 0 0.2 0.4 0.6

Overpriced software

Underutilised hardware

Regulatory fines

Keeping up with innovation

Our innovation to slow

Down time

Over-investment

Poor customer experience

Data chaos

Inflexible IT monitoring

Security

Change in average rating of top five IT management concerns between 2013 and 2015

Concern

increased

since 2013

Concern

decreased

since 2013

Source – Quocirca 2015, Masters of Machines II


irca–

Clar

ifyin

g th

e bu

sine

ss im

pact

of t

echn

olog

yChange rating of concern about:

‘security threats through compromise of IT systems’

20%

28%

14%

14%

12%

12%

6%

9%

4%

9%

44%

28%

0% 20% 40% 60% 80% 100%

2013

2015

Top concern 2nd 3rd 4th 5th Not selected

Source – Quocirca 2015 – Masters of Machines II


irca–

Clar

ifyin

g th

e bu

sine

ss im

pact

of t

echn

olog

y

Themes


The threat actors




Effective measures

Working with MSSPs


irca–

Clar

ifyin

g th

e bu

sine

ss im

pact

of t

echn

olog

y

The threat actors

Who are IT and business managers mostworried about?

– Random attacks versus targeted attacks

– Insider threats – accidental and malicious

– Cyber criminals

– Hacktivists/cyber terrorism

– Local industrial espionage

– Remote industrial espionage

– Nation state espionage

– Hackers with no aim (script kiddies etc.)


irca–

Clar

ifyin

g th

e bu

sine

ss im

pact

of t

echn

olog

yWhich area of your IT causes you the greatest security concern? (UK/USA)

1.4%

2.6%

4.2%

5.0%

9.4%

17.4%

21.4%

39.3%

46.9%

67.1%

0% 20% 40% 60% 80%

Other

DDoS

BYOD

No concerns about security

The cloud

Hardware

Insider threat

Hacking

Data loss

Threat of viruses

Source – Quocirca 2014

What keeps your CEO up

at night? (data from ISS

Threat Manifesto)


irca–

Clar

ifyin

g th

e bu

sine

ss im

pact

of t

echn

olog

yWhich group in your organisation

represents the greatest security risk?The triumph of stupidity!

2.2%

8.2%

8.2%

8.2%

9.2%

10.2%

12.4%

41.5%

0% 10% 20% 30% 40%

IT administrators

New hire staff

Contract/freelance staff

Senior management

Other

External vistors

Tech savvy users

Ignorant users

Source – Quocirca 2014: What keeps

your CEO up at night? (dara from ISS

Threat Manifesto)


irca–

Clar

ifyin

g th

e bu

sine

ss im

pact

of t

echn

olog

yUK actual concerns about threat actors

with regard to targeted attacks

2.7

2.7

3.2

3.6

3.9

4.9

1 2 3 4 5 6

Attackers with no particular aim

Remote industrial espionage

Local industrial espionage

Nation state

Hacktivists

Cyber-criminals

Source – Quocirca October 2015, The trouble at your door, UK

preview


irca–

Clar

ifyin

g th

e bu

sine

ss im

pact

of t

echn

olog

y

Themes


The threat actors




Effective measures

Working with MSSPs


irca–

Clar

ifyin

g th

e bu

sine

ss im

pact

of t

echn

olog

yHow might your organisation be targeted?

• Your people– Stolen employee devices

– Compromised identities

– A trusted user colluding with attackers

– Social engineering

– Compromised privileged users

• Your infrastructure – IoT infrastructure attacked

– Compromised via 3rd party suppliers

– Drive by downloads

– Employees devices breached

– Volume DDoS

– Distraction DDoS

– Exploited software vulnerabilities


irca–

Clar

ifyin

g th

e bu

sine

ss im

pact

of t

echn

olog

yUser attack vectors of greatest concern

in the UK

0% 20% 40% 60% 80% 100%

Stolen employee devices

Compromised normal id

Trusted user colluding

Social engineering

Compromised privileged id

UK

Major Somewhat Not much None Don't know

Quocirca October 2015, The trouble at your door, UK preview


irca–

Clar

ifyin

g th

e bu

sine

ss im

pact

of t

echn

olog

yInfrastructure attack vectors of greatest

concern in the UK


0% 20% 40% 60% 80% 100%

IoT devices

Drive by downloads

Distraction DDoS

Compromised via 3rd parties

Employees devices on public…

Vulnerabilities/exploits

A major concern Somewhat of a concern

Not much of a concern Not a concern/DK


irca–

Clar

ifyin

g th

e bu

sine

ss im

pact

of t

echn

olog

y

Themes


The threat actors




Effective measures

Working with MSSPs


irca–

Clar

ifyin

g th

e bu

sine

ss im

pact

of t

echn

olog

yWhy would your organisation be their target?

• Some mid-market organisations believe they are not a worthy target!

• Reasons to be concerned are:

– Direct attack for some unimagined reason

– Information/physical supply chain targeting

– Collateral damage via shared infrastructure (cloud)

– Internet of Things and the potential for attacks on critical infrastructure (new Quocirca research to be published soon)

• Don’t be the weak link – all organisations are involved in information supply chain


irca–

Clar

ifyin

g th

e bu

sine

ss im

pact

of t

echn

olog

yRegular online interaction in the supply chain

100%

37%

50%

58%

69%

80%

81%

0% 20% 40% 60% 80% 100%

At least one of the above

Regulators

Partners

Contractors

Consumers

Business customers

Suppliers

Source – Quocirca 2015 – Weak links


irca–

Clar

ifyin

g th

e bu

sine

ss im

pact

of t

echn

olog

yThe changing views of UK businesses

regarding targeted attacks

25%

72%

49%

21%

18%

6%

8%

0% 20% 40% 60% 80% 100%

2013

2015

Inevitable/concern for some time

Increasing concern

Not a concern/lack of awareness

Problem exaggerated/don't know



irca–

Clar

ifyin

g th

e bu

sine

ss im

pact

of t

echn

olog

y

Themes


The threat actors




Effective measures

Working with MSSPs


irca–

Clar

ifyin

g th

e bu

sine

ss im

pact

of t

echn

olog

yThe 2014-15 UK cyber-crime scene compared with all

Europe All reported attacks occurred within the last year

6%

9%

12%

27%

82%

52%

100%

0% 20% 40% 60% 80% 100%

Devasting amount/a lot of data…

Serious or significant reputational…

Definitely had data stolen

Targeting successful

Definately targeted/unsure

Definately targeted

Total respondents


irca–

Clar

ifyin

g th

e bu

sine

ss im

pact

of t

echn

olog

y

Themes


The threat actors




Effective measures

Working with MSSPs


irca–

Clar

ifyin

g th

e bu

sine

ss im

pact

of t

echn

olog

yEffective measures

Before

During

AfterCumulatively various measures

together can make a big difference


irca–

Clar

ifyin

g th

e bu

sine

ss im

pact

of t

echn

olog

yBEFORE MEASURES put in place by UK

organisations to help prevent targeted attacks

36%

47%

59%

61%

61%

68%

73%

24%

22%

18%

17%

20%

15%

15%

24%

20%

15%

11%

13%

16%

11%

14%

6%

0% 20% 40% 60% 80% 100%

Cyberattack tests/"fire drills"

Assessments of 3rd party risks

Penetration testing

User training, safe social media

Software vulnerability scanning

User training, safe web browsing

User training, email threats/phishing

In place Planning Considered Not considered



irca–

Clar

ifyin

g th

e bu

sine

ss im

pact

of t

echn

olog

yDURING MEASURES put in place by UK organisations

to help detect and stop targeted attacks

45%

46%

47%

48%

48%

51%

52%

53%

59%

67%

22%

31%

32%

25%

21%

26%

24%

21%

18%

18%

18%

12%

9%

12%

19%

12%

8%

10%

17%

9%

15%

11%

12%

15%

12%

11%

16%

16%

6%

6%

0% 20% 40% 60% 80% 100%

Correlation technology

Sandboxes

Technology to detect new malware

Application black listing

Application white listing

Detection of spear-phishing emails

Web URL reputation service

File integrity monitoring

Breach detection (e.g. DLP)

Network traffic inspection




irca–

Clar

ifyin

g th

e bu

sine

ss im

pact

of t

echn

olog

yAFTER MEASURES put in place by UK organisations

to help clear up after targeted attacks

38%

49%

57%

59%

63%

71%

25%

27%

25%

25%

19%

14%

16%

13%

10%

7%

7%

11%

21%

11%

8%

9%

11%

4%

0% 20% 40% 60% 80% 100%

Purpose built cyber forensics tools

Breach response plan

Identify the compromised data

Identify the compromised systems

Identify the compromised users

Malware clean-up technology




irca–

Clar

ifyin

g th

e bu

sine

ss im

pact

of t

echn

olog

yComposite security score and cumulative increase in

data security confidence

Source – Quocirca 2015, Room for improvement


irca–

Clar

ifyin

g th

e bu

sine

ss im

pact

of t

echn

olog

y

Themes


The threat actors




Effective measures

Working with MSSPs


irca–

Clar

ifyin

g th

e bu

sine

ss im

pact

of t

echn

olog

yDIY or service providers?

Two propositions

1. Cloud services provide more secure IT infrastructure, especially for mid-market organisations

2. Cloud based security services and MSSP engagements are a more effective way to provide security


irca–

Clar

ifyin

g th

e bu

sine

ss im

pact

of t

echn

olog

yHow important are the following potential

benefits of cloud-based services?

Average where 1 = not important at all and 5 = very important

1 2 3 4 5

Pay-as-you-go pricing

DIY convenience

No hardware investment

Single vendor for multiple services

No worries about updates

Dealing with excess capacity

Improved user response times

Improved security

Consumer-facing Non-consumer-facing

Source – Quocirca 2014, Online domain maturity


irca–

Clar

ifyin

g th

e bu

sine

ss im

pact

of t

echn

olog

y

0% 10% 20% 30% 40% 50% 60%

IPS

Malware det./block

Fraud detection

DNS protection

IDS

Continuous DDoS

SIEM

Emergency DDoS

Adv. threat intel.

Consumer-facing Non-consumer-facing

Use of on-demand security services

Percent saying they use on-demand service

Source – Quocirca 2014, Online domain maturity


irca–

Clar

ifyin

g th

e bu

sine

ss im

pact

of t

echn

olog

yConclusions?

• None of these threats are going to go away

• You will be hit at some point

• You can be prepared for this

• You don’t need to go it alone – there is plenty of help and experience available

The trouble at your door: tentative conclusion:

“Concerns about targeted attacks are well placed and investment to minimise the impact of targeted attacks has a measurable and considerable affect. Cyber-crime will not

go away but it can be fought.”


irca–

Clar

ifyin

g th

e bu

sine

ss im

pact

of t

echn

olog

yLinks to cited reports

• 2015 Masters of Machines II (sponsored by Splunk) http://www.splunk.com/en_us/resources/quocirca/master-of-machines.html

• 2015 Room for improvement (Sponsored by Digital Guardian) http://quocirca.com/content/room-improvement-building-confidence-data-security

• 2015 Weak links (sponsored by Digital Guardian) http://quocirca.com/content/room-improvement-building-confidence-data-security

• 2014 Online domain maturity (sponsored by Neustar) http://quocirca.com/content/online-domain-maturity

• 2015 The trouble at your door (sponsored by Trend Micro) to be published Oct/Nov http://quocirca.com/content/new-research-targeted-attacks-aftermath-how-well-are-you-prepared

• 2014 What keeps your CEO up at night? (sponsored by Fasoo) http://quocirca.com/content/what-keeps-your-ceo-night-insider-threat-solved-drm

http://www.splunk.com/en_us/resources/quocirca/master-of-machines.html

http://quocirca.com/content/room-improvement-building-confidence-data-security

http://quocirca.com/content/room-improvement-building-confidence-data-security

http://quocirca.com/content/online-domain-maturity

http://quocirca.com/content/new-research-targeted-attacks-aftermath-how-well-are-you-prepared

http://quocirca.com/content/what-keeps-your-ceo-night-insider-threat-solved-drm

10/21/2015 P u b l i c 36

Global reach,Local knowledgeDesigning security in a wide-spread organizationMichiel Benda, CISO

Service Provider Perspective & A Case Example

Achieving 360° View of Security for Situation

Awareness and Integrated Security Management

38© Happiest Minds – Confidential

Happiest Minds – A ‘born in digital’ company

Launched in Aug 2011

Annualised run rate: $50m in 3 years from a standing start

Investors: JP Morgan Private Equity Group, Intel Capital, Ashok Soota

1450+ People 100+ Customers 16 Cities 8 Countries 4 Continents

Deloitte Technology Fast 50: Ranked #2 (India); #13 in APAC

Industry Analyst Acknowledgement (Gartner & Zinnov)

Security Products Guide: 1 Gold, 2 Bronze

SHRM Chestnut Global Partners Employee and Wellness Rankings: Ranked #5 pan India


Holistic Approach to Digital TransformationApplications, Infrastructure & Product Engineering

Digital Transformation for enterprises and technology providers leveraging an integrated set of disruptive technologies with improved time to deployment, improved time to market, time to actionable insight

using our IP, accelerators & enablers.

Big Data & Analytics Mobility

Security

Cloud Social Computing Unified Communications

BPM, WorkflowBusiness

Integration

IoT/M2M

Digital Enterprise

Digital Transformation Services Infrastructure Management & Security Services Product Engineering Services


Happiest Minds Security Services Offerings

IT

Governance,

Risk and

Compliance

Data and

Information

Security

Identity and

Access

Management

Threat Mgmt

and

Application

security

Cyber and

infrastructur

e Security

Our SaaS Solutions

ComplianceVigil

IdentityVigil

ThreatVigil CyberVigil

Integrated Managed Services

Security Monitoring and Incident Response Security Device and Security Solutions management

Big Data Driven Analytics for Cyber Security (Risk Analytics, Threat Intelligence, Identity Analytics )

Threat and Vulnerability Management (Penetration Testing, Security Testing ( web, Mobile, Device), VA, Threat Intelligence

Advisory and Transformation Services

Focused SMAC+ Solutions

Secure Cloud Adoption Mobility Security Mgmt Big Data Security and Security Analytics IOT Security


Today’s Cyber Threat LandscapeSource: Ponemon Institute Survey

One of the biggest challenges organizations are facing when it comes to threat detection and risk mitigation is gaining visibility into their environment. Some of the key obstacles cited as contributing to a lack of visibility are:

Knowing what to look for

Having the trained resources to perform the risk analysis

Knowing what key information to contextualize

of organizations don’t believe they have sufficient resources to prevent

Advanced Threats

65%

of these Advanced Threats result in IT downtime

51%

of organizations saw an increase of advanced threats in the last 12

months

71%

of these Advanced Threats result in the theft of confidential & sensitive

information

44%

of organizations believe they have been the victim of a Cyber Threat

83%

of these Cyber Threats result in the theft of intellectual property/customer data

45%

Source: Ponemon Institute Survey


Existing Security Controls are not Completely Effective

Physical Controls(Access, Cameras, locks)

Network Security ( F/W, IDS/IPS, Proxy)

End Point Controls( Anti-Virus, FIM)

Applications/Databases(One off Security testing)

Data Security(Encryption, loose controls)

Identity Management( Access, Role, Pwd)

Policies, Regulations(Acceptable Use, Risk mgmt)

Signature Based Technologies alone are not sufficientStill Attacks are p

revalent …

..

Attacks are getting more focused and Advanced

Too many Point solutions working in Silos

Human factors can never be taken out of equation

Limited Intelligence sharing and intelligence utilization

Lack of real situation awareness, False Sense of Security

Constantly emerging new technologies <-> threat vectors

Botnets APTs

IDS/IPS AV Proxies SIEM

Awareness Social Eng..Malicious

Intent

Network Host Identity Data

Cloud Social Mobility

Zero Day Vuln. Attackers Patterns

Misconfiguration

Metrics & KPI


Security Needs in Today’s Digital world

• Risk driven: To ensure

continuous awareness and

mitigation of existing and

emerging threats, risks

• Holistic: To cover all the layers

including infrastructure,

applications, data and users

and architectures

• Adaptable: To address new

business models and enables

emerging technology adoption

• Efficient: To support business

dynamics and maximize return

on investment

Network

Servers/Endpoint

Applications

Data

Users

Governance, Risk, Compliance

Off

Prem

ise

Any Devic

e

Any Time

Any Where

C I A

• IAM – Provisioning, federation,

access governance, Consumer

IDAM, Social Logins

• Data – Integrated Data

Governance, Data classification

Mobile and Cloud data

protection• Application – Code/design

review, penetration testing

• Network – APT, Anomalies,

Application level awareness,

• GRC – Risk Assessment, Risk

analytics, and automation

• End Points – Heuristics,

Anomalies, Threat detection

and response

On

P

remise

Characteristics Technology Enablers


Transformation of Cyber Security

Reactive ResponseProactive Defense • Threat and Risk Assessment

• Know your critical Assets• Know your high risk Users• Threat intelligence gathering

Historical AnalysisReal time and Predictive • Early Detection and response

• Attack Modeling and simulations

Signature basedBehavior Based • Baseline and deviation tracking

• Whitelist and track exceptions• Advanced Analytics and Heuristics• Anomaly detection technologies

Infrastructure contextBusiness Context • Address business needs

• Business Apps context

Alert AnalysisAlert + Data Analytics • Hidden intelligence from Noise

• Advanced Reporting and visualization


Case Example: A Fortune 100 conglomerate, business spanning across energy, petrochemicals, textiles, natural resources, retail and telecommunications

Requirement

Objective: Help Achieve 360° view for Situational AwarenessBuild, transform operations for effective Security Management & Monitoring platform of the applications, databases and network devices to support 24x7 monitoring operations across the IT infrastructure and Telco infrastructure

Business Value Delivered

Securing today’s Extended and Dynamic enterprises

Transforming security to protect against new threats

Visibility and Decision support to address real risks

SILOed approach and NO contextualization

Organization policy compliance & regulations

Enable secure adoption of new technologies

Protect and Enhance Trust and Reputation

Enable Robust Risk management and incident response

How did we manage it?


Technology refresh

Integrated platform

workflow and process

engineering

Simulation and

war gaming

Data analytics

and data

sciences

Risk analytics

&decision

support

360 degree

Security

Integrated Security Management Framework

Integrated Security Building Block – Transformation for cyber protection

Industry/Domain Specific Alignment

Threat Protection Framework

Cyber Risk Analytics

Data Governance framework

Integrated Incident Response

Agile Processes

Response

Detection

Prevention


Log Management

Compliance Reporting

Perimeter Security

Insider Threats

Advanced Persistent Threats

Data leakages

Application Fraud/Transaction

• Viruses, Botnets• Phishing, SQL

Injection• Attacks & Malicious

Code• Suspicious Activity• Anomalies

• Unauthorized Access

• Privilege misuse• Policy Violation• Acceptable Usage• High Risk Users• Access Monitoring

• Audit Trail• Security device

status• Configuration

Mgmt

• Suspicious behavior• Anomalies• Cross device

correlation• Covert Channels

• Clear Text Communication

• File Transfers• IM/P2P• IP/Industry specific

• Unauthorized Transaction

• Frauds/exceptions• DOS/DDOS

• Log Collection• Log Storage• Ad-hoc reporting

• Emerging Threats and Risk• Evolving Business Needs• Increasing Regulatory

Requirements

• People Skills• Product Capability• Process Performance

Phased Approach for 360° view - for Complete Situational Awareness


Threat and Vulnerability Management

Application Security

User & identity Security

Host Security Solution

Perimeter Security

Data Security

Advanced Threat Mitigation

Platform Security

Environment Aware• Asset Priority• Configuration Info• Policies, Regulations

External Threat Intelligence

Risk Aware• Vulnerabilities• Zero day attacks• Malware, Botnets• APTS

Identity Aware• Privilege Users• High Risk Users• External Users

Data Aware• Data Access• Data Leakage• Database Activity

Ris

k A

sses

smen

t, P

olic

y, R

egu

lati

on

s, L

aws

Custom Application

Packaged Application

Web Applications

Bu

siness A

pp

sInspection engine

Business Aware• Exceptions• Fraudulent activity• Performance

Forensics Engine

Ne

two

rk View

Traffic

Sessions

Anomalies

Complete Visibility• Session recreation• Payload analysis• Anomalies• Incident alerting

Ad

vanced

An

alytics

Patterns & Anomalies

Long Term Trending

Mining & Modeling

Hidden Intelligence• Slow moving attacks• False positive reduction• Multi dimensional reports

Big Data Platform

Reporting

Co

rrelation

Log

Co

llection

Contextualization

Governance Risk Compliance

• Near Real Time View/Dashboards, • Decision Support System

• Robust Processes, Skilled Resources• Platform and tools engineering

1

2 3

5

4

Reference Architecture for 360° view - Complete Situational Awareness

Thank You

Q&A panel

Isaac George

Thank you for listening!

Any questions?

BobTarzey

Michiel Benda

PrasenjitSaha

Sli.do event code: 151015

‘Achieving 360° view of security for complete situational awareness’ was hosted by Happiest Minds

Happiest Minds is a next generation digital transformation, infrastructure, security and product engineering services company with 1450+ people, 16 locations and serving over 100 customers. For more information please contact:

Website:

www.happiestminds.com

Twitter

@happiestminds

Email:

[email protected]

http://www.happiestminds.com/

mailto:[email protected]

achieving 360° view of security for complete situational awareness

Presentations & Public Speaking