View
1.249
Download
0
Category
Preview:
Citation preview
.
McAfee Confidential
Scott Taschler, Technical Director, Advanced Threat Detection
Intelligent Security Operations
Operationalizing Threat Intelligence
.
McAfee Confidential
Introduction
Through Intelligent Security Operations you can
• Identify and disrupt complex attacks
• Find, monitor and investigate emerging threats
• Effectively detect, analyze, repair affected systems, and adapt to future attacks
Today we’ll explore how Threat Intelligence operates as a critical piece of a mature security operations.
2
.
McAfee Confidential
Agenda
• Threat Intelligence as a critical component of Security Operations
• Intel Security solution for Intelligent Security Operations
• Cyber Resilience Maturity Model
• Threat Intelligence in action
• Foundation
• Operational
• Trusted
• Outcomes delivered through mature Threat Intelligence
3
.
McAfee Confidential
A challenging and stressful environment
Security’s Perfect Storm
Many Tools andLimited Expertise
Masses ofSecurity Data
1
0
1
0
1
1
1
0
0
0
1
0
0
1
1
0
1
1
1
0
0
0
1
0
1
0
1
1
0
1
0
1
1
1
0
0
0
1
0
Time to Detectand Respond
1
1
0
0
0
1
0
1
0
0
0
1
0
1
0
1
1
0
1
1
0
!
Many organizations are turning to Threat Intelligence to get a leg up
.
McAfee Confidential
What is Threat Intelligence?
There are many different types of Threat Intelligence.
For our discussion we’ll focus on Observables and Indicators.
.
McAfee Confidential
Trends with Threat Intelligence
6*Source: SANS IR Survey, August 2015
Who’s using it?
• 75% of organizations find TI important to security operations
Where are they getting it?
• 56% use vendorfeeds
• 54% use community feeds
• 53% use open source feeds
What’s it doing for them?
• 48% report fewer incidents due to improved prevention
• 51% see faster, more accurate detection and response
.
McAfee Confidential
Optimize operations by integrating threat, security, and risk management
The Intel Security Solution
7
Collect, correlate and prioritize critical events for effective threat visibility
Move from an “alert and investigations” model to an “active response” model
Integrate third party threat intelligence, reputation feeds, and vulnerability status
McAfee Enterprise Security Manager
.
McAfee Confidential
Evolution into a Cyber Resilience Maturity Model
8
Security by products
Protection
Poor visibility
Many process are manuals
There aren't SLAs
There aren't standard process
High confidence in persons and their knowledge
FOUNDATIONLEVEL
OPERATIONALLEVEL
TRUSTED LEVEL
BASICLEVEL
Focused to Cyber Defense
Compliance
Security by Silos
Process aren't sophisticated andpersons are trained in products
SLAs defined but there is not complete coverage, its metrics are not consistent
Not intelligence shared
Balanced Cyber Defense capability to protect, detect and correct on key attack vectors
Security by integration coordinated
Intelligence shared
Hunt and Respond using Threat Intelligence (IOC)
Better quality in the indicators
Process and Procedures more efficient (much of them are automatic)
Less person-dependency (less TCO and better ROI)
Measurable and Balanced Cyber Defense capability to protect, detect and correct against external and insider threats
High capabilities to do forensic analysis and analytic research
Security model that supports directly the corporate objectives according to the vertical market
Well defined indicators and process to get it
Indicators to support the SLA
.
McAfee Confidential
Threat Intelligence Maturity
9
FOUNDATIONLEVEL
OPERATIONALLEVEL
TRUSTED LEVEL
BASICLEVEL
Drowning in Intelligence
Harnessing Intelligence
Creating and Acting on
Intelligence
Blissful Ignorance
EVOLUTION TO A MATURITY MODEL
DEFINING A ROADMAP (SOLUTIONS AND SERVICE PATHS)
.
McAfee Confidential
Foundation Level: Drowning in Intelligence
10
Collect Collate and Hunt Act and Validate…Repeat
.
McAfee Confidential
Explanation and Live Demo
Operational Level: Harnessing Intelligence
To better take advantage of Threat Intelligence, we require:
• A unified repository to keep it
• Streamlined workflows
• Look for hits past, present, and future
• Take immediate, decisive action when hits are discovered
• Validate that the problem is resolved
.
McAfee Confidential
Operational Level: Harnessing Intelligence
121212
Collect Collate and Hunt Act and Validate
McAfee Threat Intelligence
Exchange (TIE)
McAfee Enterprise Security Manager
(ESM)
McAfee Active Response
(MAR)
.
McAfee Confidential
Trusted Level: Creating and Acting on Intelligence
13
Explanation and Live Demo
To take the next step, we need to automate
• Creation and collection of Threat Intelligence
• Analysis of Threat Intelligence
• Acting on Threat Intelligence
.
McAfee Confidential
Trusted Level: Creating and Acting on Intelligence
14
Collect Collate and Hunt
McAfee Threat Intelligence
Exchange (TIE)
McAfee Enterprise Security Manager
(ESM)
McAfee Active Response
(MAR)
McAfee Advanced Threat Defense
(ATD)
Act and Validate
.
McAfee Confidential
Real Outcomes
15
Results of Operationalizing Threat Intelligence
MetricFoundation
LevelOperational
LevelTrusted
LevelTime to detect Hours+ 60 min 2 minTime to protect 1 day+ 65 min 3 minTime to complete response Days 90 min 10 minConsoles Many 2 2Manual Steps Many 7 1
.
McAfee Confidential
1 slide
Technical and Business Benefits Summarized
• Greatly reduced time to protection
• Automated detection and remediation
• Significant reduction in labor
• Instant validate threat has been properly dealt with
• Much broader visibility - 100% situational awareness
16
.
McAfee Confidential
Intel Security, the right security partner
• Breadth of solution set needed for mature solution
• Broad, mature services organization to help deliver success
• Open framework, to support wide range of intelligence sources
17
.
McAfee Confidential
Next steps
• Let’s discuss how we can help you better leverage Threat Intelligence
• Pilot project
18
Recommended