1. Why visibility is a must
in your security strategy?

2. Adam Stetson Welcome Netwrix engineer Phone: 1-949-407-5125 x2907

3. Agenda The IT world we live in: the device mesh
The future of security: expert predictions
Perimeter defense: turning security inside out
Notable breaches
How IT auditing supplements security strategy
Questions and answers

4. The IT World We Live in: The “Device Mesh”

5. Device mesh
— is the proliferation of smart, digital, wireless, sensor-based, interconnected devices that people use personally and professionally to access applications, systems and information.
Personal lives and business operations become increasingly digitized. The Internet of Things expands from labs, plants and corporate facilities to civic environments. The ecosystem of consumer Internet-connected devices, operational tools and facilities is poised to soar in the coming years. Researchers from various firms predict that the number of devices connected to the Internet will reach 30 to 38 billion in 2020, up from an13.4 billion in Installed base of consumer IoT devices is expected to exceed the installed base of smartphones and tablets combined by The IoT market is predicted to grow to $1.7 trillion in 2020 (from $655 billion in 2014).
Other IT buzz words today:
Internet of Things, Cloud Computing, Big Data, Advanced Analytics, Advanced Machine Learning, Bring-Your-Own-Device, Convergence, DevOps, PaaS/SaaS

6. Examples The ones we already got used to:
And here are some of the examples of connected devices that we already got used to and actively use on a daily basis.

7. Examples The ones that are growing in popularity: Self-driving cars
Connected smart home devices
Smart clothing
Personal health devices
Robots assistants
Other sensor-based devices and wearables for work and leisure
And the popularity and spread of the following devices is quickly growing. Examples include self-driving cars, smart light bulbs, smoke detectors, climate stations, kitchenware, smart clothing, personal health monitoring devices.

8. Interconnectivity-related Security Concerns
Devices are widely used for work (BYOD spreads in the business world) but are lacking inherent security at the same time.
Mobile applications and systems have multiple vulnerabilities.
Few companies are adequately measuring up the demands of new security standards in response to a new ubiquitous computing paradigm.
Businesses are building deeper real-time connections with their suppliers, partners, governments, and customers, collecting and selectively sharing vast amounts of data. The value of stored and in-transit information is rising rapidly. Mobile devices, such as tablets and smartphones, are now used by many individuals in their daily lives and in professional area to boost personal productivity. In fact, Forrester finds that one-third of all employees are considered “anywhere/anytime workers.” More and more, a modern workforce is a mobile workforce.
Many companies now allow employees to bring their own devices to work, due to perceived productivity gains and cost savings. However, even more companies don’t support BYOD polices but cannot really do anything about their employees using mobiles. The security concerns are really huge:
Mobile devices are used to access sensitive corporate systems and information. The same devices are used to access risky, untrusted networks/risk-averse organizations sites.
The devices and mobile applications are not as secure as stationary corporate IT components.
Companies are not able or willing to put adequate security measures in place.
At the same time, the adversaries are looking for new ways to steal the information, leverage it, and benefit from it. Today’s connectivity technologies leave them plenty room for successful work.

9. The Concept of Network Perimeter Is Now Blurred
Proliferation of mobile technologies is one of the reasons why the concept of network perimeter has become blurred.

10. Analogy: Cyberwarfare in the Past
Some time ago information security looked similar to medieval warfare. Organizations could literally build the walls around their IT infrastructures with antiviruses and firewalls and feel safe and secure behind those walls.

11. Analogy: Modern Cyberwarfare
Nowadays perimeter security is no longer enough. Hostilities have bypassed the walls and take place inside IT infrastructures. Today insider threats outrank external attacks.

12. Insider threats stats 58% Privileged user accounts 60% Insiders
2016 IBM Cyber Security Intelligence Index …
“Of all responsible for security attacks”
60% Insiders
44.5% Malicious Insiders
15.5% Inadvertent Insiders
2016 Vormetric Data Threat Report …
“Which IT insiders pose the greatest risks?”
58% Privileged user accounts
45% Executive management accounts
According to the findings of IBM 2016 Cyber Security Intelligence Index research, over a half of all attackers are “insiders”. 60% of all attacks (attack being a malicious activity attempting to collect, disrupt, deny, degrade, or destroy information system resources or the information itself) were carried out by those who had insider access to organizations’ systems. 44,5% of those were malicious insiders and 15,5% were inadvertent actors. Interestingly, the share of attacks carried out by malicious insiders has grown tremendously from 31.5% to 44.5% (13 percentage points).
Results from the 2016 Vormetric Insider Threat Report show that in terms of threat actors the largest risk to an organization’s sensitive data is presented by privileged users (admins, DBAs, etc.) and executive management.

13. Insider Threats Handling Will Become a Priority
Insider threats outrank external attacks already today.
Insider threats are becoming more difficult to deal with.
A security focus will be set on establishing proper control over user activities inside corporate networks.
Moreover, the insider threat landscape is becoming more difficult to deal with as the range of miscreants moves beyond employees and privileged IT staff. It now includes outsiders who have stolen valid user credentials; business partners, suppliers, and contractors with inappropriate access rights; and third-party service providers with excessive admin privileges.
Organization’s current or former employees, contractors, or other business partners who have authorized access to an organization's data pose one of the greatest risks. This is the risk of misuse of access privileges to steal, leak or destroy customer, company or employee data.
And since insider threats represent a major security blind spot, their handling becomes a #1 priority.
It’s difficult to prevent insider misuse of privileges. Once a user logs in, he or she is authorized in the system, so how do you know this user is not violating security rules?

14. Analogy: Cyberwarfare in the Cloud
Moreover, today hostilities take place not only on land (on-premises), but also in the air (in the cloud). And can you build the walls in the air?
This is why the focus of IT security professionals should be set on establishing proper controls over user activities inside corporate network (both on-premises and in the cloud), and on gaining visibility into what users are doing within the network.

15. Cloud Security Survey
Hybrid Cloud Infrastructure
Cloud deployment
65%
Security and loss of physical control over data
Cloud technology concerns
69%
Last year Netwrix released State of Cloud Security Survey. We asked IT professionals to share their experience with cloud adoption. Here are some main takeaways.
Adoption of hybrid cloud is growing rapidly and will continue to grow further. However security concerns and lack of physical control over data still hinder cloud adoption.
Making sure that only right people access the right data becomes even harder in hybrid environments. This is why the focus of IT security professionals should be set on establishing proper controls over user activities inside corporate network (both on-premises and in the cloud), and on gaining visibility into what users are doing within the network.
“The majority of companies feel that the cloud is insecure because it lacks visibility into user activities; thus, they would never know what is going on. Companies are afraid that migration to the cloud would increase risks of unauthorized access (69% of companies).”
“Overall, 71% of enterprises perceive continuous auditing of cloud infrastructure as a very important part of security guarantees that could ensure data integrity in the cloud. ”
Unauthorized Access
Cloud security concerns
Knowing who does what, when and where in the cloud provides security guarantees for 71% of enterprises.

16. Sample Data Breaches That Could Have Been Prevented
So let’s talk about data breaches.

17. Data Breaches of 2015
So these are a few examples of loud 2015 breaches.
And now let’s see a couple of particular examples of data breaches now.

18. Data Breach Case Study
The United States Office of Personnel Management
Announcement:
June 2015
Start:
March 2014 or earlier
Affected:
21,5 million people
What leaked:
social security numbers, names, dates and places of birth, addresses and other
Hacking method:
attackers had gained valid user credentials, likely through social engineering.
State involvement:
linked to Chinese hackers / Chinese government
Brief about this OPM breach:
One of the biggest hacks of the recent time (minimum 21 million people affected)
There are beliefs that that was a state-sponsored attack (Chinese hackers suspected)
The breach lasted for more than a year before detection
The breach occurred with stolen credentials (presumably from a contractor)
Social engineering was likely the tactic of obtaining credentials
The data lost in the breach not only included staff’s personal data but also some state secrets.
Before this breach the OPM already had a reputation of an agency with security related problems. There were different investigations and reports that claimed the following:  "incomplete security authorization packages, weaknesses in testing of information security controls, and inaccurate Plans of Action and Milestones”. This indicates that OPM didn’t have strict internal control, continuous monitoring, auditing, policy assessment, etc.
There were huge difficulties during investigations of the breach linked to the fact that the organization relied heavily on to event logs. As the breach last for a long time, many events have been overwritten, and audit trail lost. Thus, it was extremely difficult to assess the scope of the breach and find the intruders’ traces.
As an outcome, the OPM has already paid 133 million dollars as compensation to the affected people, 1,8 million dollars for a specific notification software. It’s likely, the OPM will have to pay even more in the future (e.g., pay for the identity protection upgrades, credit monitoring services and so on.)
Most high-profile cyberattacks of recent years could have been prevented if companies and government agencies had followed basic security practices. Even the advice handed out by federal government isn’t adhered to by its own agencies, as was clearly evidenced in the hack experienced by the Office of Personnel Management (OPM) where at least 5.6 million fingerprints and 21 million social security records, applicant usernames and passwords were stolen. The breach may have exposed sensitive information of U.S. military, law enforcement, diplomatic and intelligence officials around the world, including “foreign contacts” and relatives living overseas.
Hackers may have used information stolen from a private government contractor to ultimately break into federal systems, according to sources briefed on the matter. That type of information, sources said, could be exploited to conduct "social-engineering" operations, potentially using the data to pressure or trick employees into further compromising their agencies.
The U.S. government was having a tough time figuring out the exact scope of the cyber-assault on the Office of Personnel Management because much of the digital trail was erased by the time authorities detected and began investigating the breach. Many government computer systems hold onto “data logs” - records that document access to files, specific user activity, system traffic and more -- for up to 60 days. But “these events happened months ago, so a lot of the forensic evidence is just not there. And so the investigators have a really hard time trying to piece all that information together.”
The government awarded technology firm Advanced Onion a $1.8 million contract to help locate and notify those affected by the data heist. More than $133 million was awarded to Identity Theft Guard Solutions to provide victims credit and identity-theft insurance for three years.

19. Data Breach Case Study Experian Announcement: September 2015 Start:
September 2013 or earlier
Affected:
15 million people
What leaked:
names, addresses, birthdates, social security numbers and ID numbers
Hacking method:
investigation is ongoing (presumably identity theft through phishing.)
Brief about this Experian breach:
- A recent hack (minimum 15 million people affected)
It is likely that the breach lasted for 2 years or even longer
Social engineering was likely the tactic of obtaining credentials
Experian is known to be active in acquiring business. But here what they write about it: “What the board of directors at Experian wanted security-wise and the security capabilities on the ground were two completely different things,” Tate said. “Senior leadership there said they were pursuing a very aggressive growth-by-acquisition campaign. The acquisition team would have a very strict protocol on how they assess whether a business may be viable to buy, but the subsequent integration of the business into our core security architecture was just a black box of magic in terms of how it was to be implemented. And I’m not saying successful magic at all.”
As an outcome (as of date of December 2015), minimum 32 court appeals have been submitted. The company will likely have to pay for “credit-monitoring services” и “identity resolution services for as long as the customer needs it” and so on. The T-Mobile CEO claims: “I am incredibly angry about this data breach and we will institute a thorough review of our relationship with Experian”). So this indicates certain reputation damage. Plus Experian may have to make certain of its services free for the customers.
Attackers breached one Experian North America business unit server, containing the personal data of about 15 million T-Mobile customers. Experian said the one-off costs incurred by responding to the breach has amounted to roughly $20 million which included notifying impacted individuals, offering them free credit monitoring services and informing the appropriate government agencies of the intrusion. But that might not be the end of Experian’s expenses related to the breach.
Now Experian is doing the following to remediate the issue:
assessing and removing malware or improper connectivity
performing assessment of isolation procedures of the affected server and associated systems
engaging U.S. and international law enforcement
increased monitoring of the affected servers and associated systems
validating that their security measures and practices stand up to the high standards to which they hold themselves.

20. How Auditing Can Solidify Your IT Security Strategy
So why is IT auditing is a critical component of any IT security strategy?

21. The Challenge
Lack of visibility into insider activity increases the risk of data breaches because IT departments are unable to spot malicious activity before data is compromised.
According to Ponemon 2015 “Third Annual Study: Is Your Company Ready for a Big Data Breach?” report, lack of visibility into end-user access to sensitive and confidential information is the biggest barrier to improving the ability of IT security to respond to a data breach (60%). This data shows how firms struggle to protect their data resources from those already legitimately ‘inside the fence'. It is often a case of ineffective management of ‘privileged' users on corporate networks that causes this type of data breach incident. Every organization will have employees or contractors who have excessive access rights. And control over these users’ activity is often a weak link in the data security strategy (it is not monitored or analyzed for malicious behavior).

22. IT Auditing Is the Answer
IT auditing delivers visibility into what’s happening in IT environments.
Access to sensitive data
Abnormal user activity
Privilege abuse
Changes to critical configurations
Data exfiltration
IT auditing brings such visibility into IT environment.
Being aware of system and security settings changes, data access, user behavior, and system configuration states is a great way to detect security incidents and to control adherence to security policies. Only with continuous surveillance you can ensure early detection of insider threats and timely response to each violation before it evolves into a breach.
IT auditing is critical to maintaining a stable and secure IT environment and must be included in your security strategy.

23. Why Auditing Is a Must-Have Component
Validation of security controls and policies
Your organization may adopt security frameworks and best practice policies but how do you know whether employees follow those policies and procedures?
Auditing helps organizations to validate adherence to policies and improve security posture.
Human error accounts for 52 percent of the root cause of security breaches, according to a new study from CompTIA, which surveyed individuals from hundreds of companies in the U.S. Asked about the top examples of human error, 42 percent of those surveyed cited "end user failure to follow policies and procedures," another 42 percent cited "general carelessness," 31 percent named "failure to get up to speed on new threats," 29 percent named "lack of expertise with websites/applications," and 26 percent cited "IT staff failure to follow policies and procedures. When you focus on standards and processes to enable security you need to validate those things. Auditing should validate that your security standards and processes are actually that what you believe to be true. Certainty requires an external review.

24. Why Auditing Is a Must-Have Component
1. Validation of security controls
Investigation of security incidents and preventing breaches
An organization needs to catch security incidents in due time. No single incident must be left without attention.
Auditing helps organizations detect incidents and obtain the required valuable context so that the incidents do not grow into breaches.
IT auditing is effective in detecting and letting you know about the following types of incidents:
Permissions abuse (or in other words – wrong distribution of permissions, changes to permissions that go against corporate security policy).
Suspicious data access (or access attempts to sensitive data by users who do not have permissions, or abnormally frequent attempts to data, or attempts of access outside of working hours, etc.)
Other abnormal user activity (for example, too many changes to system configuration and data within a certain period of time; too many deletions or additions of any objects of files; creation of other user accounts, giving them permissions, etc.)
System configuration changes without proper approval or without formal change management process.
As IT auditing collects all such events and makes possible easy reporting, it becomes more quick and easy to investigate each particular incident and get a full scope of necessary details in each case. This definitely works for security and prevention of data breaches.

25. Why Auditing Is a Must-Have Component
1. Validation of security controls
2. Preventing breaches
Proving security controls are and have always been in place
To pass internal and external audits, compliance policies and mechanisms must be reviewed and validated on a continuous basis.
Auditing enables organizations to provide auditors with historical evidence of continuous compliance.
All IT-related compliance regulations have one thing in common – these regulations aim to provide a framework to protecting data. Compliance policies and mechanisms must be continuously reviewed and validated due to the dynamic nature of information security, organizational growth and other factors. Besides that, compliance auditors who perform assessments of whether or not particular policies are being followed in an organization and whether the organization complies with the requirements, can ask to provide evidence of compliance over a certain period of time, rather than in a particular point in time during the assessment. Companies need to be able to demonstrate that, over a prolonged period of time, it has been controlling its adherence to regulations. IT auditing as an ongoing practice helps organizations validate that specific policies and procedures are adopted and it enables implementation of adequate internal controls and establishment of compliance regime.

26. Why Auditing Is a Must-Have Component
1. Validation of security controls
2. Preventing breaches
3. Proving compliance
Ensuring business continuity and efficiency of operations
IT workers are making changes to data and systems they work with all the time. Certain changes may impact the work of other employees and even be the cause of an outage or downtime.
Auditing provides means to quickly find a root cause of problems. Troubleshooting user issues and repairing services takes less time and effort.
Incorrect or unauthorized changes to system configurations can impact sustainability of business processes and cause IT services to stop. Downtime usually have cost implications. The longer the outage is – the more damage to the business it brings. According to 2015 State of IT Changes Survey done by Netwrix, the majority of IT pros admit that they still are not able to control sustainable performance of their IT systems and they continue to make changes that become a root cause of system downtime. 40% of organizations make changes that both degrade service performance and security every month, and a third of organizations are at risk every week.
IT auditing detects issues and reports them in due time pulling insight out of the noise and chatter, which allows organizations to easily spot the problem, analyze it and resolve it.

27. Why Auditing Is a Must-Have Component
1. Validation of security controls
2. Preventing breaches
3. Proving compliance
4. Ensuring business continuity
Delivering accountability without mundane change management
Not all organizations can practically enable day-to-day change management practice. Accountability, however, is critical.
Auditing delivers visibility into who is doing what in your IT environment.
User accountability means holding the user of an application, system or data accountable for his or her actions. By action, we mean any changes to the existing information, application or system. In practice, change management is not so an easy practice to enable. IT administrators (and power users) are the ones who are most likely to make critical changes that would have a potential to lead to a data leak or operations failure. But these people are busy workers, and it is not easy to make them put every change they make on record. When changes aren’t documented, it leads to two obvious consequences: it’s more difficult to discover an unwanted change that can cause a breach, and it’s difficult to find the one responsible for the incident.
IT auditing automatically places all changes on record and delivers all the required details, such as who, what, when and where. This ensures user accountability and brings clarity to things that are happening in the IT environment.

28. Netwrix Auditor What We Do? A visibility and governance platform
that enables control over changes, configurations, and access
in hybrid cloud IT environments
by providing security analytics to detect anomalies in user behavior and investigate threat pattern before a data breach occurs.
Netwrix Auditor is a visibility and governance platform that enables control over changes, configurations, and access in hybrid cloud IT environments by providing security analytics to detect anomalies in user behavior and investigate threat pattern before a data breach occurs.

29. Netwrix Auditor Applications
Netwrix Auditor for Active Directory
Netwrix Auditor for Exchange
Netwrix Auditor for Office 365
Netwrix Auditor for Windows File Servers
Netwrix Auditor for EMC
Netwrix Auditor for NetApp
Netwrix Auditor for Windows Server
Netwrix Auditor provides the broadest coverage of audited IT systems, including Active Directory, Exchange, Office 365, Windows file servers, EMC storage devices, NetApp filer appliances, SharePoint, SQL Server, VMware and Windows Server.
Netwrix Auditor for VMware
Netwrix Auditor for
SQL Server
Netwrix Auditor for SharePoint

30. Netwrix Auditor Benefits
Detect Data Security Threats – On Premises and in the Cloud
Pass Compliance Audits with Less Effort and Expense
Increase the Productivity of Security and Operations Teams
Bridges the visibility gap by delivering security analytics about critical changes, state of configurations and data access in hybrid cloud IT environments and enables investigation of suspicious user behavior.
Provides the evidence required to prove that your organization’s IT security program adheres to PCI DSS, HIPAA, HITECH, SOX, FISMA/NIST800-53, COBIT, ISO/IEC and other standards.
Relieves IT departments of manual crawling through weeks of log data to get the information about who changed what, when and where and who has access to what.
Netwrix Auditor enables organizations to detect of data security threats, pass compliance audits and increase productivity of security and operations teams.
Detect Data Security Threats – On Premises and in the Cloud
Detect suspicious insider activity at early stages
Get a high-level overview of employee activity across your IT infrastructure with Enterprise Overview dashboards. See how often changes are made, which users are performing suspicious actions, which systems are affected and more.
Investigate anomalies in user behavior
Whenever you detect a change or data access attempt that violates your corporate security policy, use our interactive Google-like search to investigate why and how it happened so you can prevent similar incidents from occurring in the future.
Prevent data exfiltration
Make sure that only the eligible employees in your organization have access to critical resources by getting a complete picture of effective permissions and file activity on your file servers and NAS.
Pass Compliance Audits with Less Effort and Expense
Address auditors’ questions faster
Quickly provide answers to auditors’ questions, such as what changes were made to the Enterprise Domain Admins group during the past year and who made those changes. With Netwrix Auditor, what used to take weeks now takes minutes.
Take advantage of out-of-the-box compliance reports
Auditors require proof that specific processes and controls are — and have always been — in place. Prove your compliance with out-of-the-box reports aligned with compliance controls.
Store and access your audit trail for years
Many compliance regulations require organizations to retain their audit trails for extended periods. Netwrix Auditor enables you to keep your audit trail archived in a compressed format for more than 10 years, while ensuring that all audit data can easily be accessed at any time.
Increase Productivity of IT Security and Operations Teams
Keep tabs on what’s changing in your environment
See when a specific change was made, who made it, and what was changed, including the values before and after the change. This detailed information is available for every change in your on-premises and cloud-based IT systems.
Simplify reporting
Netwrix Auditor supplies more than 170 predefined reports and dashboards that are easy to customize using built-in filtering, grouping and sorting. You can export the data to PDF, XLS and other formats, set up subscriptions, and much more.
Speed report delivery
Jettison slow, manual reporting processes that require users to request the reports they need from IT and wait their turn in the queue. With Netwrix Auditor, stakeholders can subscribe to scheduled reports or use the Netwrix Auditor client to create reports on demand.

31. and Business Challenges
Addressing the IT
and Business Challenges
IT Administrator
Generate and deliver audit and compliance reports faster.
IT Security Administrator
Investigate suspicious user activity before it becomes a breach.
IT Manager
Take back control over your IT infrastructure and eliminate the stress of your next compliance audit.
IT Director, CIO/CISO
Prevent data breaches and minimize compliance costs.
Over 160,000 IT departments worldwide rely on Netwrix to secure IT infrastructure, prove compliance and increase operational efficiency.
Our software is tailored to serve the needs of system administrators, IT managers, IT directors, compliance auditors, security officers and MSPs.

32. About Netwrix Corporation
Year of foundation: 2006 Headquarters location: Irvine, California Global customer base: over 7000
Customer support: global 24/5 support with 97% customer satisfaction
Recognition: Among the fastest growing software companies in the US with 95 industry awards from Redmond Magazine, SC Magazine, WindowsIT Pro and others
And now a few words about Netwrix. We’ve been around since 2006…

33. Netwrix Customers Financial Healthcare & Pharmaceutical
Year of foundation: 2006
Headquarters location: Irvine, California
Global customer base: over 7000
Customer support: global 24/5 support with 97% customer satisfaction
Recognition: Among the fastest growing software companies in the US with 95 industry awards from Redmond Magazine, SC Magazine, WindowsIT Pro and others
Healthcare & Pharmaceutical
Federal, State, Local, Government GA
We have clients in pretty much every vertical: government, heavy industries, healthcare, financial, IT.
Industrial/Technology/Other

34. Industry Awards and Recognition
Year of foundation: 2006
Headquarters location: Irvine, California
Global customer base: over 7000
Customer support: global 24/5 support with 97% customer satisfaction
And we keep receiving industry specific awards.
All awards:

35. Thank You! Questions? Adam Stetson Netwrix engineer
x2907