Data Analytics for Security Intelligence

Camil Demetrescu

Dept. Computer, Control, and Management Engineering Credits: Peter Wood, First Base Technologies LLP

Data Driven Innovation Rome 2016 – Open Summit Roma Tre University, May 20 2016

Outline

•  Big data

•  Advanced threats – current situation

•  Why big data for security?

•  How can big data help?

•  Big data security challenges

•  Conclusions

20/5/2016 Data Driven Innovation Rome 2016 Page 2

Big data Every day, we create 2.5 quintillion bytes of data. 90% of the data in the world today has been created in the last two years alone.

http://www-01.ibm.c/software/data/bigdata/

2.5 quintillion = 2.5 exabytes = 2.5 x 1018 = 2.500.000.000.000.000.000 bytes

•  Sensors used to gather climate information •  Posts to social media sites •  Digital pictures and videos •  Purchase transaction records •  Cell phone GPS signals

Outline

•  Big data

•  Conclusions

Malware events per hour

Organisations on average are experiencing malware-related activities once every three minutes. Receipt of a malicious email, a user clicking a link on an infected website, or an infected machine making a call back to a command and control server.

How breach occurred

The Post Breach Boom, Ponemon Institute 2015 Survey of 3,529 IT and IT security practitioners

When the breach was discovered

The Post Breach Boom, Ponemon Institute 2015 Survey of 3,529 IT and IT security practitioners

Reasons for failing to prevent the breach

Extrapolated cost of breach

Outline

•  Big data

•  Conclusions

Data driven information security: examples

•  Analyze system/applications log files •  Analyze network traffic •  Identify anomalies and suspicious activities

•  Correlate multiple sources of information into a coherent view

Why do we need big data systems?

•  System Log files that can grow by gigabytes per second

•  Network data captures, which can grow by 10s of gigabytes per second

•  Intrusion Detection/Protection log files that can grow by 10s of gigabytes per second

•  Application Log files that can grow by gigabytes per second

http://www.virtualizationpractice.com/big-data-security-tools-22075/

Traditional scenarios

Traditional defences: •  Signature-based anti-virus •  Signature-based IDS/IDP •  Firewalls and perimeter devices

Traditional approach: •  Data collection for compliance •  Check-list mindset •  Tactical thinking

New challenges

Complex threat landscape: •  Stealth malware •  Targeted attacks •  Social engineering

New technologies and challenges: •  Social networking •  Cloud •  BYOD / consumerisation •  Virtualisation

Conventional vs. advanced approaches

Outline

•  Big data

•  Conclusions

Data-driven information security: early times

•  Bank fraud detection and anomaly-based intrusion detection systems.

•  Credit card companies have conducted fraud detection for decades.

•  Custom-built infrastructure to mine big data for fraud detection was not economical to adapt for other fraud detection uses (healthcare, insurance, etc.)

Cloud Security Alliance

Data analytics for intrusion detection

Intrusion detection systems – Security architects realized the need for layered security (e.g., reactive security and breach response) because a system with 100% protective security is impossible.

1st generation

2nd generation

Security information and event management (SIEM) – aggregate and filter alarms from many sources and present actionable information to security analysts.

3rd generation

Big data analytics in security (2nd generation SIEM) – correlating, consolidating, and contextualizing diverse security event information, correlating long-term historical data for forensic purposes

How can big data analytics help?

•  Advanced persistent threat (APT) detection? •  Integration of IT and physical security?

•  Predictive analysis

•  Real-time updates

•  Behaviour models

•  Correlation

•  … advising the analysts?

•  … active defence?

How can big data analytics help?

Outline

•  Big data

•  Conclusions

Big data security challenges

•  Bigger data = bigger breaches?

•  New technology = security later?

•  Information classification

•  Information ownership (outputs and raw data)

•  Big data in cloud + BYOD = more problems?

Big data security risks

•  New technology will introduce new vulnerabilities

•  Attack surface of the nodes in a cluster may not have been reviewed and servers adequately hardened

•  User authentication and access to data from multiple locations may not be sufficiently controlled

•  Regulatory requirements may not be fulfilled, with access to logs and audit trails problematic

•  Significant opportunity for malicious data input and inadequate data validation

Big data privacy concerns

•  De-identifed information may be re-identified

•  Possible deduction of personally identifiable information

•  Risk of data breach is increased

•  "Creepy" Factor: consumers may feel that companies know more about them than they are willing to volunteer

•  Big brother: predictive policing and tracking potential terrorist activities. Harm individual rights or deny consumers important benefits (such as housing or employment) in lieu of credit reports.

http://www.ftc.gov/public-statements/2012/03/big-data-big-issues

Outline

•  Big data

•  Conclusions

Conclusions

•  As with all new technologies, security in big data use cases seems to be an afterthought at best

•  Big data breaches will be big too, with even more serious reputational damage and legal repercussions

•  All organisations need to invest in research and study of the emerging big data security analytics landscape

•  Big data has the potential to defend against advanced threats, but requires a big re-think of approach

•  Relevant skills are key to successful deployment, only the largest organisations can invest in this now

Big data to collect

•  Logs •  Network traffic

•  IT assets

•  Sensitive / valuable information

•  Vulnerabilities

•  Threat intelligence

•  Application behaviour

•  User behaviour

Data Analytics for Security Intelligence

Data & Analytics

Business Intelligence and Analytics

Business Intelligence & Business Analytics

JSA Series Secure Analytics Appliances with IBM Security X-Force Threat Intelligence · 2016. 5. 16. · Intelligence augments the JSA Series Secure Analytics Appliances intelligence

Business Analytics and Intelligence

Big Data Analytics for Security Intelligence

C INTELLIGENCE Analytics & Insights Event Agenda€¦ · Competitive Intelligence Tools and Methodology Thought Leadership in CI and Market Intelligence INTELLIGENCE Analytics & Insights

Navigating the Maze of Cyber Security Intelligence and Analytics _ Anything Connected

Security Operations & Incident Management KA · 2020. 7. 29. · Event Management Cyber-Threat Intelligence Security Orchestration, Analytics and Reporting Security Operations and

DEVNET-1158Cognitive Threat Analytics - Behavioral Breach Detection & Security Intelligence Interchange via TAXII/STIX API

RSA ADVANCED SECURITY OPERATIONS CENTER · RSA Security Analytics RSA Advanced ... RSA SECURITY ANALYTICS ARCHITECTURE ... Intelligence feeds APT Domains Suspicious Proxies Malicious

Security Analytics: The Promise of Artificial Intelligence, Machine Learning, and Data Science

Redefining Military Intelligence Using Big Data Analytics · 72 AUTUMN 2015 ³ Redefining Military Intelligence Using Big Data Analytics HARIDAS M National security and defence related

Security Intelligence: Driving Security From Analytics to Action...Security Intelligence: By Design Functionally, security intelligence is a method by which data and insights are collected,

Adaptively Secure Broadcast: Threat Analytics & Security ... · the security intelligence of a broadcast system comprehensively with a novel concept of collective intelligence. The

Corporate Overview - Secez · Gurucul Risk Analytics (GRA) is a behavior based security analytics and intelligence platform on open choice of big data. Gurucul Risk Analytics (GRA)

Enorasys Security Analytics · 2018-03-18 · encodegroup.com info@encodegroup.com Enorasys Security Analytics Security Intelligence…that matters Augments your early warning capabilities

Big Data Analytics for Security Intelligence - Cloud Security Alliance

Intelligence Analytics Society's Analytics Challenge 2016

Visual Intelligence & Video Analytics

Business Analytics and Intelligence€¦ · IIM Bangalore Course Brochure Business Analytics and Intelligence Programme Page 2 Certificate Programme on Business Analytics and Intelligence