1. Layer Zero: Enabling The Security Stack Brandon Hoffman CTO, Lumeta © 2015 Lumeta Corporation

2. The Security Stack SSO, IAM, Entitlements Identity WAF, AppSec Analyzers, Application Testers Application DLP, Encryption, Session Managers, Proxies Data HBFW, HIDS, Vuln Scanners, Agents/Shims, MDM Host/Device Router ACLs, Firewalls, IPS.IDS, NAC, Modelers Network Cloud NGFWs APT/ATA Controls No single device or product will provide full security. A security stack is needed.

3. The Security Stack Cloud NGFWs APT/ATA Controls These devices leverage data and metadata generated or analyzed by devices in other layers. In most cases they need this data to be effective.

4. The Security Stack: Missing Links The challenge is that all of these devices need other data that is not available from any of these sources. Cloud NGFWs APT/ATA Controls Needed:  Real time index of all network devices  Validation of zone/segment access  Shadow IT identification  Perimeter validation  Leak paths  Unknown connected networks Needed:  Real time index of all network devices  Validation of zone/segment access  Shadow IT identification  Perimeter validation  Leak paths  Unknown connected networks Needed:  Real time index of all attached devices  Full device profiling  Multi homed host identification  Unmanaged/unscanned hosts (agent/scan discrepancy) Needed:  Real time index of all attached devices  Full device profiling  Multi homed host identification  Unmanaged/unscanned hosts (agent/scan discrepancy) Needed:  Invalid/self-signed/unmanaged certificates  Traffic behind NAT/Proxies  Historic data asscoiation  Real time index of port usage  HTTP(s) banner enumeration  File share accessibility Needed:  Invalid/self-signed/unmanaged certificates  Traffic behind NAT/Proxies  Historic data asscoiation  Real time index of port usage  HTTP(s) banner enumeration  File share accessibility

5. The Security Stack: Layer Zero Foundational intelligence to enable the security stack Cloud NGFWs APT/ATA Controls Network Situational Awareness via Recursive Network Indexing

6. The Security Stack: Layer Zero Network Situational Awareness Steps Cloud NGFWs APT/ATA Controls Network Situational Awareness via Recursive Network Indexing INDEX COMPREHEND PREDICT

7. Network Situational Awareness Foundational intelligence to enable the security stack. INDEX COMPREHEND PREDICT Network Situational Awareness via Recursive Network Indexing INDEXING: Identify all devices that comprise the network and all devices attached Identify certificates Identify all ports in use Identify all banners and file shares Profile all devices Identify Shadow IT INDEXING: Identify all devices that comprise the network and all devices attached Identify certificates Identify all ports in use Identify all banners and file shares Profile all devices Identify Shadow IT COMPREHEND: Determine unscanned hosts Determine agentless/unmanaged hosts Determine multi-homed hosts Validate zone/segment access Determine leak paths Determine unknown/unmanaged networks COMPREHEND: Determine unscanned hosts Determine agentless/unmanaged hosts Determine multi-homed hosts Validate zone/segment access Determine leak paths Determine unknown/unmanaged networks PREDICT: Identify C2 leak paths Correlate vulnerabilities/malware to inappropriate access Feed automated patching Enhance asset inventory systems Trend data for historic association and review Close asset management gaps PREDICT: Identify C2 leak paths Correlate vulnerabilities/malware to inappropriate access Feed automated patching Enhance asset inventory systems Trend data for historic association and review Close asset management gaps

8. Recursive Network Indexing INDEXING: Identify all devices that comprise the network and all devices attached Identify certificates Identify all ports in use Identify all banners and file shares Profile all devices Identify Shadow IT INDEXING: Identify all devices that comprise the network and all devices attached Identify certificates Identify all ports in use Identify all banners and file shares Profile all devices Identify Shadow IT COMPREHEND: Determine unscanned hosts Determine agentless/unmanaged hosts Determine multi-homed hosts Validate zone/segment access Determine leak paths Determine unknown/unmanaged networks COMPREHEND: Determine unscanned hosts Determine agentless/unmanaged hosts Determine multi-homed hosts Validate zone/segment access Determine leak paths Determine unknown/unmanaged networks PREDICT: Identify C2 leak paths Correlate vulnerabilities/malware to inappropriate access Feed automated patching Enhance asset inventory systems Trend data for historic association and review Close asset management gaps PREDICT: Identify C2 leak paths Correlate vulnerabilities/malware to inappropriate access Feed automated patching Enhance asset inventory systems Trend data for historic association and review Close asset management gaps Cloud NGFWs APT/ATA Controls Network Situational Awareness via Recursive Network Indexing Get the data you need for the security you demand!