1. 1© Copyright 2014 EMC Corporation. All rights reserved. Applying the Power of Data Analytics to Cyber Security Dr. Robert W. Griffin Chief Security Architect RSA, the Security Division of EMC robert.griffin@rsa.com blogs.rsa.com/author/griffin blog.emc2.de/executive-world/ project-sparks.eu/blog/ @RobtWesGriffin www.linkedin.com/pub/robert-griffin/0/4a1/608

2. 2© Copyright 2014 EMC Corporation. All rights reserved. Disruption and Transformation Infrastructure Transformation Mobile Cloud Less control over access device and back-end infrastructure Threat Landscape Transformation APTs Sophisticated Fraud Fundamentally different tactics, more formidable than ever Business and Legal Transformation More hyper-extended, more digital Extended Workforce Networked Value Chains Big Data http://www.emc.com/collateral/industry-overview/h11391-rpt-information-security-shake-up.pdf?pid=sbiclandingpage- sbicspecialreport-122112

3. 3© Copyright 2014 EMC Corporation. All rights reserved. TIME Evolving Attack Goals and Methods Worms/ Viruses Simple DDoS Phishing Pharming APTs Multi-Stage Hacker Collaboration Disruptive Attacks Destructive Attacks Intrusive Attacks Advanced DDoS Sophisticated Mobile Attacks IoT Attacks

4. 4© Copyright 2014 EMC Corporation. All rights reserved. Traditional Security Is Not Working Source: Verizon 2013 Data Breach Investigations Report 97% of breaches led to compromise within “days” or less with 72% leading to data exfiltration in the same time 78% of breaches took “weeks” or more to discover 66% took “months or more”

5. 5© Copyright 2014 EMC Corporation. All rights reserved. Intelligence is the Game Changer

6. 6© Copyright 2014 EMC Corporation. All rights reserved. P E L N Visibility Capture Time Data Enrichment Packets, Logs, Endpoints, NetFlow Business & Compliance Context Data Collection and Rationalization

7. 7© Copyright 2014 EMC Corporation. All rights reserved. Analysis Endpoint Threat Detection Correlate Multiple Data Sources Out-of-the-box Content Generating Information Big Data & Data Science

8. 8© Copyright 2014 EMC Corporation. All rights reserved. Action Prioritized & Unified Analyst Workflow Investigate down to finest details Integrate SOC Best Practices Investigation and Remediation

9. 9© Copyright 2014 EMC Corporation. All rights reserved. Communication Valley Reply (Italy) Leveraging Intelligence-Driven Security Requirements: Efficient, cost-effective management and reporting of security Reduce cost of services delivery Improved MSSP service as competitive advantage Solution: Automatically tracked and reported on client risk and compliance Enhanced incident triage Improved event analysis http://www.emc.com/collateral/customer-profiles/h11982-reply-cp.pdf

10. 10© Copyright 2014 EMC Corporation. All rights reserved. Domain A RISK SCORE Traffic content types Suspicious domains often host many services on the same server. Number of IP addresses Malicious domains use many IP addresses to evade static IP watchlists. Number of domain name owners associated with an IP address A high number of domain owners associated with a system is suspicious GETS vs PUT/POSTs Domains where the ratio of POSTs to GETs is high are more likely malicious. Number of users hitting a domain relative to complexity A complex domain that few people access is more likely to be malicious. Low Risk Domain ALow Risk Domain AHigh Risk Example: Detect suspicious domain connections Identifying suspicious domains is difficult – and identifying hosts that have ever communicated with one is even harder.

11. 11© Copyright 2014 EMC Corporation. All rights reserved. Domain A RISK SCORE Use of cookies Malicious sessions seldom use cookies. Bytes uploaded vs. downloaded Malicious sessions often upload far more than just a URL request. Use of referrer strings Most web sessions come from clicking on another link, resulting in a “referrer string”. Malicious sessions seldom do. Other RSA uses several other identifiers to determine the risk score. URL lengths Malicious attacks often embed themselves deep in web servers, resulting in unusually long URL lengths. Low Risk Domain AMedium Risk Domain AHigh Risk Example: Discover beaconing hosts Traffic from hosts ‘beaconing’ to command and control hosts can look like normal traffic. Data science helps identify outliers.

12. 12© Copyright 2014 EMC Corporation. All rights reserved. Capture, enrich and analyze data from across your network. Threat Intelligence | Rules | Parsers | Feeds | Reports | RSA Research LIVE INTELLIGENCE Investigation Advanced Analytics Compliance Endpoint Analysis Session Reconstruction Incident Management ACTIONANALYSIS LIVE VISIBILITY Capture Time Meta-Data Enrichment LIVE Security analytics architecture LOGS PACKETS ENDPOINT NETFLOW ENRICH

13. 13© Copyright 2014 EMC Corporation. All rights reserved. Dallas Mexico City EMEA HQ Singapore DC Network Collection Log Collection Log Collection Network Collection Pivotal Network Collection 2 nd Pivotal Cluster 1 st Pivotal Cluster Capture Time Streaming Context Assets Identities Vulns Log Collection Log Collection Capture Time Log Collection Log Collection Capture Time Network Collection Log Collection Log Collection Capture Time Local Archive Central Archive Scalable, enterprise-wide deployment Efficient data collection and enrichment Streaming analytics close to the source Centralized, deep-analytics across the enterprise Sample enterprise deployment Captures data from across data centers and feeds enriched data to the analytics platform

14. 14© Copyright 2014 EMC Corporation. All rights reserved. Balancing Security and Privacy Information Sprawl Mobility of End Users More Threats More Regulations Business Challenge Security Privacy Meet Regulations Mitigate Emerging Threats Self-Service Secure Account Access and Use Protect Information Ease of Use

15. 15© Copyright 2014 EMC Corporation. All rights reserved. 15 The Internet of Things Transformation in Opportunity and Risk Security Management User Interface Data Collection Data Storage Data Integration Data Management

16. 16© Copyright 2014 EMC Corporation. All rights reserved. Planning Your Journey Siloed compliance focus, disconnected risk, basic reporting Managed automated compliance, expanded risk focus, improved analysis/metrics Advantaged fully risk aware, exploit opportunity Reduce compliance cost Gain resource & risk visibility Manage known & unknown risks Identify new business opportunities

17. 17© Copyright 2014 EMC Corporation. All rights reserved. Thank You robert.griffin@rsa.com blogs.rsa.com/author/griffin blog.emc2.de/executive-world/ project-sparks.eu/blog/ @RobtWesGriffin www.linkedin.com/pub/robert-griffin/0/4a1/608