ibm cognitive security era with watson - · pdf fileibm qradar advisor with watson. 12 ibm...
TRANSCRIPT
1 IBM Security Summit 2017
IBM Cognitive Security Era with Watson
April 18, 2017Anthony AurigemmaVice President, IBM Security Operations & Response
2 IBM Security
Today’s security drivers
COMPLIANCEHUMAN
ERROR
SKILLS GAPADVANCED
ATTACKSINNOVATION
3 IBM Security
Attackers break through conventional safeguards every day
Source: IBM X-Force Threat Intelligence Index - 2017
$7Maverage cost of a U.S. data breachaverage time to identify data breach
201 days
20141+ Billion records
2015Unprecedented Impact
2016
4+ Billion records
4 IBM Security
Traditional security practices at the breaking point
MILLION
unfilled security positions
by 20201.585 security tools from 45 vendors
PERCENT of CEOs are
reluctant to share incident
information externally68
5 IBM Security
Threats Alerts Analysts
available
Quick Insights : Current Security Status
Available
time
”There is a massive amount of noise out there; the human brain can’t
process everything on a day-to-day basis. We need something to help,
something like AI or cognitive technologies.”Chad Holmes – Principal and Cyber-Strategy, Technology and Growth
Leader (CTO) at Ernst & Young LLP
Knowledge
needed
Is this really sustainable?
6 IBM Security
The need for cognitive security is real
“You start getting better at the soft
side of security and you can provide
additional context to the hard side of
security which helps makes better
decisions and vice versa – a clearer
picture about risk – that is what we
are on the cusp of. That is what
cognitive computing prepares us for.”
David Shipley, Director of Strategic Initiatives,
Information Technology Services, University of
New Brunswick
“There is a massive amount of
noise out there, the human
brain can’t process everything
on a day to day basis – we
need something to help,
something like AI or cognitive
technologies.”
Chad Holmes, Principal and Cyber
Strategy, Technology and Growth
Leader (CTO) at Ernst & Young LLP
“The 24/7 nature of security
operations presents a
challenge that is costly for
most organizations to staff,
which is where the appeal of
cognitive-enabled security
comes in — it never sleeps or
fatigues.”
Michael Pinch, Chief Information
Security Officer, University of
Rochester
7 IBM Security
Almost two thirds believe cognitive security solutions will address gaps – with ~20% planning to adopt in 2-3 years
Expectations Top 3 perceived benefits Adoption
Believe that
“cognitive security”
solutions can
significantly slow
down cybercriminals
57%
#1 Intelligence
#2 Speed
#3 Accuracy Although only 7% of the total
sample are currently working
on implementing cognitive-
enabled security solutions
today – this rises to 21% in
the next 2-3 years
3X
Today Next 2-3 years
Improve detection and
incident response decision-
making capabilities (40%)
Significantly improve
incident response time
(37%)
Provide increased
confidence to discriminate
between events and true
incidents (36%)
8 IBM Security
Cognitive security provides the ability to unlock and action the potential in all
data, internal and external, structured and unstructured. It connects obscure
data points humans couldn’t possibly spot, enabling enterprises to
more quickly and accurately detect and respond to threats, becoming more
knowledgeable through the cognitive power to understand, reason and learn.
Introducing and understanding
Cognitive Security
9 IBM Security
A tremendous amount of security knowledge is created for human consumption, but most of it is untapped
• Industry publications
• Forensic information
• Threat intelligence commentary
• Analyst reports
• Conference presentations
• News sources
• Newsletters
• Tweets
• Wikis
A universe of security knowledge
Dark to your defenses
Typical organizations leverage only 8% of this content*
Human Generated
Knowledge
Traditional
Security Data
security eventsviewed each day200K+
security researchpapers / year 10K
securityblogs / year720K
security relatednews articles / year180K
reported softwarevulnerabilities 75K+
• Security events and alerts
• Logs and configuration data
• User and network activity
• Threat and vulnerability feeds
1 Forrester Research : Can You Give The Business The Data That It Needs? , 2013
IBM INTERNAL ONLY
10 IBM Security
Today’s Reality
• We are in a constant race against time to research
and analyze the increasing number of alerts and
anomalies
• We need greater confidence in our ability to make
accurate assessments of potential security incidents
• We need to make our threat intelligence actionable
and ensure that it is up to date and relevant
• We need to overcome our struggles in acquiring,
training, and retaining enough security talent
I’m overwhelmed with alerts and anomalies to investigate. There isn’t enough time and I’m worried I am going to miss something big.”
11 IBM Security
Cognitive Security Starts HereIBM Security Introduces a Revolutionary Shift in Security Operations
IBM CONFIDENTIAL
• Employs powerful cognitive capabilities to investigate and qualify security incidents and anomalies on behalf of security analysts
• Powered by Watson for Cyber Security to tap into vast amounts of security knowledge and deliver insights relevant to specific security incidents
• Transforms SOC operations by addressing current challenges that include skills shortages, alert overloads, incident response delays, currency of security information and process risks
• Designed to be easily consumable: delivered via IBM Security App Exchange and deployed in minutes
NEW! IBM QRadar Advisor with Watson
12 IBM Security
Watson unlocks a tremendous amount of security knowledge enabling rapid and comprehensive investigation insights
• Continually growing and
adapting
• Leverages the power of
collaboration and
crowdsourcing
• Creates and finds paths
and linkages missed by
humans
• Performs cognitive
exploration of suspicious
activities and behaviors
• Learns, adapts and
doesn’t forget
13 IBM Security
QRadar Advisor
IBM CONFIDENTIAL
• Manage alerts
• Research security events and anomalies
• Evaluate user activity and vulnerabilities
• Configuration
• Other
• Data correlation
• Pattern identification
• Thresholds
• Policies
• Anomaly detection
• Prioritization
Security Analytics
Security Analysts Watson for Cyber Security
• Security knowledge
• Threat identification
• Reveal additional indicators
• Surface or derive relationships
• Evidence
• Local data mining
• Perform threat research using Watson for Cyber
Security
• Qualify and relate threat research to security incidents
• Present findings
QRadar Watson Advisor
SECURITY
ANALYSTS
SECURITY
ANALYTICS
QRadar
Advisor
Watson
for Cyber
Security
IBM Security Introduces a Revolutionary Shift in Security Operations
14 IBM Security
• Review the incident data
• Review the outlying events for anything
interesting (e.g., domains, MD5s, etc.)
• Pivot on the data to find outliers
(e.g., unusual domains, IPs, file access)
• Expand your search to capture more data
around that incident
• Search for these outliers / indicators
using X-Force Exchange + Google +
Virus Total + your favorite tools
• Discover new malware is at play
• Get the name of the malware
• Gather IOC (indicators of compromise)
from additional web searches
• Investigate gathered IOC locally
• Find other internal IPs are potentially
infected with the same Malware
• Qualify the incident based on insights
gathered from threat research
• Start another investigation around each
of these IPs
Cognitive Tasks of a Security Analyst in Investigating an Incident
Time
consuming
threat
analysis
There’s got to be
an easier way!
Apply the intelligence and
investigate the incident
Gather the threat research,
develop expertise
Gain local context leading
to the incident
15 IBM Security
QRadar Advisor with Watson in Action
Knowledgegraph
SuspiciousActivities
Deviceactivities
Other Devices
Stage 1 – Feature Hunt
Incident/Anomaly
Results and new features
SuspisousDevices
Threat
Stage 2 – Cognitive Investigation
Features
Stage 3 – Wider Feature Hunt
Incident Diagnosis
QRadar
Advisor
QRadar
Advisor
16 IBM Security
Identify Suspicious Activities
Understand • Target system
• Motive
• Objective
• Duration
Identify Compromised hosts
Understand • Target vulnerabilities
• Objective
• Attack sequence
• Scope
Identify Patient zero
Understand • Name
• Family
• Sources
• Delivery method
• Impact
Identify and understand sophisticated threats
QRadar Watson Advisor automates the cognitive tasks necessary to enrich security incidents. Security analysts are empowered with actionable insights to identify and understand sophisticated threats
MALWARE EXPLOITSSUSPICIOUS
ACTIVITY
SEE THE BIG PICTURE
“I’d equate the traditional cybersecurity analysis model to standing at the side of a freeway trying to identify potential
lawbreakers. As traffic whizzes by, it’s impossible to identify who is speeding or who might be in a stolen vehicle,”
...“Using Watson, on the other hand, is like flying over the same freeway in a helicopter.
17 IBM Security
Significantly reduce threat research and response time with QRadar Watson Advisor
RemediationInvestigation and Impact AssessmentIncident TriageDays
to Weeks
Manual threat analysis
RemediationInvestigation and
Impact Assessment
Incident
Triage
Minutes
to Hours
QRadar Watson Advisor assisted threat analysis
Quick and accurate analysis of security threats, saving precious time and resources
• Accelerates incident triage with more
automation and analysis depth
• Alleviates pressure of skills gap
• Reduces risk discovering previously
missed links
• Augments contributions of security teams
18 IBM Security
IBM QRadar Watson Advisor powered by Watson for Cyber Security
BRINGING THE POWER OF COGNITIVE SECURITY TO THE SECURITY ANALYST
IBM CONFIDENTIAL
• Consults more information sources
than humanly possible
• Maintains the currency of security
knowledge
• Removes human error and
dependency on research skills
• Repeats analysis automatically as the
incident develops or new intelligence
becomes available
• Leverages the power of collaboration
and crowdsourcing of threat
intelligence and activity for more
accurate insights
19 IBM Security
IBM Security: An integrated and intelligent security immune system
Criminal detection
Fraud protection
Workloadprotection
Cloud accesssecurity broker
Access management
Entitlements and roles
Privileged identity management
Identity management
Data access control
Application security management
Application scanning
Data monitoring
Device management
Transaction protection
Content security
Malware protection
Endpoint detectionand response
Endpoint patching and management
Virtual patching
Firewalls
Network forensics and threat management
Sandboxing
Network visibility and segmentation
Indicators of compromise
IP reputation Threat sharing
Vulnerability management Incident response
User behavior analysis
Threat hunting and investigationCognitive security
Threat and anomaly detection
ibm.com/security
securityintelligence.com
xforce.ibmcloud.com
@ibmsecurity
youtube/user/ibmsecuritysolutions
© Copyright IBM Corporation 2016. All rights reserved. The information contained in these materials is provided for informational purposes only, and is provided AS IS without warranty of any kind, express or implied. IBM shall not be responsible for any damages arising out of the use of, or otherwise related to, these materials. Nothing contained in these materials is intended to, nor shall have the effect of, creating any warranties or representations from IBM or its suppliers or licensors, or altering the terms and conditions of the applicable license agreement governing the use of IBM software. References in these materials to IBM products, programs, or services do not imply that they will be available in all countries in which IBM operates. Product release dates and / or capabilities referenced in these materials may change at any time at IBM’s sole discretion based on market opportunities or other factors, and are not intended to be a commitment to future product or feature availability in any way. IBM, the IBM logo, and other IBM products and services are trademarks of the International Business Machines Corporation, in the United States, other countries or both. Other company, product, or service names may be trademarks or service marks of others.
Statement of Good Security Practices: IT system security involves protecting systems and information through prevention, detection and response to improper access from within and outside your enterprise. Improper access can result in information being altered, destroyed, misappropriated or misused or can result in damage to or misuse of your systems, including for use in attacks on others. No IT system or product should be considered completely secure and no single product, service or security measure can be completely effective in preventing improper use or access. IBM systems, products and services are designed to be part of a lawful, comprehensive security approach, which will necessarily involve additional operational procedures, and may require other systems, products or services to be most effective.
IBM DOES NOT WARRANT THAT ANYSYSTEMS, PRODUCTS OR SERVICES ARE IMMUNE FROM, OR WILL MAKE YOUR ENTERPRISE IMMUNE FROM, THE MALICIOUS OR ILLEGAL CONDUCT OF ANY PARTY.
FOLLOW US ON:
THANK YOU
BACKUP
22 IBM Security
Unlocking a new partnership between security analysts and QRadar
SECURITY ANALYST SECURITY ANALYST with QRadar Advisor
Enterprise
Security
Analytics
Cognitive
Investigation
and Insights
Enterprise
Security
Analytics
Cognitive Security
SEE THE BIG PICTURE
ACT WITH CONFIDENCE AND SPEED
“QRadar Advisor provides us with the much-needed insight to take offences we may have ignored and spend the time digging into potential attacks in order to truly understand our risk and the needed actions to mitigate a threat.”
“Results in the enhanced context graph is the
same type of information that one of the
analysts would find during their manual
research, but BIG savings in time. Maybe they
would come up with 1/3 to ½ of what was
found by Watson analysis during 3 hours of
manual research.”
23 IBM Security
“Cognitive security has so much potential — you can
meet your labor shortage gap, you can reduce your
risk profile, you can increase your efficiency of
response. It can help you understand the narrative
story. People consume stories — this happened, then
this happened, with this impact, by this person.
Additionally, cognitive can lower the skills it takes to
get involved in cybersecurity. It allows you to bring
in new perspectives from non-IT backgrounds into
cracking the problem.”
David Shipley – Director of Strategic Initiatives, Information
Technology Services, University of New Brunswick
24 IBM Security
There is a massive amount of noise out
there; the human brain can’t process
everything on a day-to-day basis. We need
something to help, something like AI or
cognitive technologies.
Chad Holmes – Principal and Cyber-Strategy, Technology and Growth
Leader (CTO) at Ernst & Young LLP
25 IBM Security
A new era is emerging where man and
machine work together to address three
gaps – in intelligence, speed and
accuracy.
The Cognitive Security Era Starts Here
26 IBM Security
Revolutionizing how security analysts will work
SECURITY ANALYST SECURITY ANALYST with QRadar Advisor
Enterprise
Security
Analytics
Human Generated
Security
Knowledge
Enterprise
Security
Analytics
Cognitive Security
GAIN POWERFUL INSIGHTS
REDUCE THE SECURITY GAPS
• Tap into the vast array
of data to uncover new patterns
• Get smarter over time
and build instincts
• Automate the threat research that
otherwise would have to be done by
security analysts
• Triage threats and make
recommendations with accuracy, at speed
and scale
27 IBM Security
QRadar Advisor with Watson for Cyber Security Addresses the Major Challenges SOC teams Face
Security teams face a race against time, having to research & analyze
increasing number of high priority security incidents
Staggering volume and noise in security data coupled with lack of actionable
intelligence plagues security teams
Security teams are not confident in their ability to consistently make
accurate assessments of potential security incidents
Acquiring, training and retaining security talent is a growing challenge that
security organizations are contending with
Faster investigations to clear backlog easier
Enriched timely information to provide greater context of
each incident
Automated reasoning that is refined with feedback and
experience to improve accuracy and develop trust
A trusted advisor to complement security analysts