Insider Threat Solution from GTRI
•
2 recomendaciones•994 vistas
Insider threats come in a variety of forms and may be malicious or simply the result of negligence. Insider attacks can cause more damage than outsider threats, so it is important that organizations understand how to protect against and remedy insider threats. Learn more about insider threats and GTRI's Insider Threat Security Solution in this presentation. (Source: GTRI) This presentation includes information about Cisco Stealthwatch, which goes beyond conventional threat detection and harnesses the power of NetFlow. With it, you get advanced network visibility, analytics, and protection. You see everything happening across your network and data center. And you can uncover attacks that bypass the perimeter and infiltrate your internal environment. (Source: Cisco)
Recomendados
Más contenido relacionado
La actualidad más candente
La actualidad más candente (20)
Destacado
Destacado (18)
Similar a Insider Threat Solution from GTRI
Similar a Insider Threat Solution from GTRI (20)
Más de Zivaro Inc
Más de Zivaro Inc (20)
Último
Último (20)
Insider Threat Solution from GTRI
- 1. WWW.GTRI.COM © 2016 Global Technology Resources, Inc. All rights reserved. Insider Threat Solution Understanding Prevalence and Preventative Measures
- 2. © 2016 Global Technology Resources, Inc. All Rights Reserved. 2 What Are Insider Threats? • Insider access: Employees, contractors • Exploits/exceeds authorized access • Affects security, systems, daily operations • Not all “malicious” or intentional • Negligence can result in a damaging attack
- 3. © 2016 Global Technology Resources, Inc. All Rights Reserved. 3 53% 34% 34% 30% Unintentional Exposure Intellectual Property Theft Unauthorized Access Insider Threat Incidents Are Pervasive Source: 2013 US State of Cybercrime Survey, CSO Magazine, U.S. Secret Service, Software Engineering Institute CERT Program at Carnegie Mellon University, and Price Waterhouse Cooper, June 2013 31% Theft of Other Assets/Data Experienced Insider Attack With Damage Greater Than Outside Attack
- 4. © 2016 Global Technology Resources, Inc. All Rights Reserved. 4 Insider Threats Impact Everyone Retail Media and Entertainment Government Industry Healthcare Energy and Utilities Small Business More…
- 5. © 2016 Global Technology Resources, Inc. All Rights Reserved. 5 Insider Threat Damage Leaked Unreleased Films 70 Million Customers PII Breach Attacked, Breached Substation 4 Million Personal Records Proprietary Formula Stolen, Sold PIN Pads in 63 Stores Hacked Sensitive Information, Salaries $10M Lawsuit Settlement $100M Security Program “Crown Jewel” Intelligence to China Chinese Competitor Bought Large, Class Action Law Suit
- 6. © 2016 Global Technology Resources, Inc. All Rights Reserved. 6 Insider Threat Protection • Best-of-breed solutions are important, but not fool proof • Vigilance is necessary to protect against insider threats that affect data, reputation, safety and the bottom line
- 7. © 2016 Global Technology Resources, Inc. All Rights Reserved. 7 Insider Threats: Where Exposure Occurs • Device Level Threats • Network Level Threats • User Proficiency Threats • User Behavior Threats • Social Media Threats
- 8. © 2016 Global Technology Resources, Inc. All Rights Reserved. 8 Network Level Threats Combating Threats: Critical Capabilities Profile Non- Standard Network Communication Detect Slow, Stealthy User Device Threats Identify Suspect Network Activity
- 9. © 2016 Global Technology Resources, Inc. All Rights Reserved. 9 Network Level Threat Protection • In-depth Security Context • Complete Picture of Network Activity • Actionable Security Intelligence • Faster Threat Detection • Advanced Forensic Tools • Improved Incident Response STEALTHWATCH BY LANCOPE
- 10. © 2016 Global Technology Resources, Inc. All Rights Reserved. 10 Summary • Insider Threats o Pervasive o Not limited to high-profile targets o Big business: Losses of $2.9 trillion annually1 • Insider Threat Protection o Starts with C-Level commitment o More than screening, perimeter security o Best accomplished with experienced partner/services provider 1. 2013 US State of Cybercrime Survey, CSO Magazine, U.S. Secret Service, Software Engineering Institute CERT Program at Carnegie Mellon University, and Price Waterhouse Cooper, June 2013
- 11. WWW.GTRI.COM © 2016 Global Technology Resources, Inc. All rights reserved. sales@gtri.com | 877.603.1984 | @gtri_global Thank You
- 12. Mark Belcher Ken Daniels Bart Gates Stealthwatch-Cisco Stealthwatch-CiscoStealthwatch-Cisco PAM CSE SAM Cisco Stealthwatch
- 13. IOT and what does it mean?
- 14. Shrinking the Attack Surface?????
- 15. Pace of Disruption 124 years 25 years 12 years
- 16. Scale of Disruption $300B $40B 1 Million Rooms
- 18. Cisco Security – Simple will get you breached but complex will get you beat! AnyConnect Threatgrid ISE AMP Talos TrustSec Firepower ASA ESA WSACisco StealthWatch OpenDNS
- 19. AnyConnect
- 20. Open DNS
- 21. ISE
- 22. ESA/WSA
- 23. ASA
- 24. FirePower/AMP
- 25. Talos
- 26. ThreatGrid
- 27. TrustSec
- 28. StealthWatch
- 29. Signature Anomaly Behavior Advanced Detection Methods Signature = Object against blacklist • IPS, Antivirus, Content Filter Behavior = Inspect Victim behavior against blacklist • Malware Sandbox, NBAD, HIPS, SIEM Anomaly = Inspect Victim behavior against whitelist • NBAD, Quantity/Metric based—not Signature based Signature Behavior Anomaly Known Exploits BEST Good Limited 0-day Exploits Limited BEST Good Insider Abuse Limited Limited BEST
- 30. enterprise network Attacker Perimeter (Inbound) Perimeter (Outbound) Infiltration and Backdoor establishment 1 C2 Server Admin Node Reconnaissance and Network Traversal 2 Exploitation and Privilege Elevation 3 Staging and Persistence (Repeat 2,3,4) 4 Data Exfiltration 5 Anatomy of a Data Breach
- 31. What does Stealthwatch do? Network Segmentation Internal Threat Visibility Incident Response
- 32. © 2014 Lancope, Inc. All rights reserved. Ideal Visibility Solution? 32 Full packet capture everywhere…? InternetAmador Delta Solano Edge Routing DMZ Switching Datacenter Switches Perimeter Security Core SwitchingHub Router WAN Routers Access Switching IDF Datacenter WAN DMZ Access 32
- 33. © 2014 Lancope, Inc. All rights reserved. Ubiquitous visibility via Telemetry 33 … your infrastructure is the source: InternetAmador Delta Solano Border DMZ Virtual Hosts Perimeter Datacenter WAN Hub WAN Access IDF Datacenter WAN DMZ Access Flow Flow Flow Flow Flow Flow Flow Flow Flow Flow Flow Flow Flow Flow Flow Flow 33 * For every 1MB of External (N/S) traffic 5MB of Internal (E/W) traffic is created
- 34. © 2014 Lancope, Inc. All rights reserved. Visibility via Flow Metadata 34 Telephone bill Flow
- 35. Host Groups – The Secret Sauce! 35 • Location – site – branch • Datacenter • Function – application • Business unit • Sensitivity – compliance • New malware families • Point-of-sale malware • Banking malware • Keylogger, exfil data • DDoS Outside – Internet • Geo-location • Business partners • Cloud providers • Social media Inside – Internal Command & Control Apply Network Segmentation Build Logical Boundaries
- 36. Profile Business Critical Processes
- 37. StealthWatch Enables Network Visibility EVERYTHING must touch the network KNOW every host Know what is NORMAL What else can the network tell me? RECORD every conversation Gain Context-Aware Security Company Network Assess Audit Posture Response Context Detect Alert to CHANGE Store for MONTHS
Notas del editor
- Insider threats come in a variety of types but can best be defined at the highest level as: A current or former employee or contractor who exploits or exceeds his or her authorized level of network, system or data access in a manner that affects the security of the organizations data, systems or daily operations Not all of these threats are due to a maliciously intended insider, in fact the majority start as simple negligence whereby an otherwise non-threatening individual behaves in a manner not reflective of best practice and as a result opens the door for a malicious third party. The result is a damaging attack facilitated by the often simple act of negligence.
- Critical capabilities in combating network level threats Determine whether a device or set of devices is being accessed or utilized in a manner indicating that the host is communicating in non-standard ways across different end points both within and outside of the network Detect slow and stealthy threats that may leverage user devices Identify network activity suggestive of data exfiltration Can your organization make use of your infrastructure as a sensor for threats and then guard against them?
- Monitor Lancope's StealthWatch System leverages existing resources to deliver pervasive network visibility and continuously monitor for advanced threats. In-depth security context creates a complete picture of network activity. Detect The StealthWatch System transforms network data into actionable security intelligence for faster threat detection. Identify suspicious behaviors that could signify APTs, insider threats, DDoS attempts or malware. Analyze The StealthWatch System provides advanced forensic tools to help you understand the who, what, when, where, why and how of security breaches for improved incident response. Respond Continuously collect, analyze and store large amounts of valuable network data to effectively respond to threats before, during and after a security incident.
- While it is easy to rationalize that insider threats won’t happen to your organization it has become clear that this breed of threat is pervasive. Not limited to the obvious targets of government, financial and healthcare every organization type and size has a need to address this. As an example, real estate has a reported rate of 37% of attacks being insider in type. Losses of $2.9 trillion annually in employee fraud are reported globally and the US alone suffered $40 billion in losses during the most recently reported year. Dedicating resources to addressing this potential exposure should be a concern at the highest level in your organization. Screening employees and contractors and maintaining strong perimeter security is not enough to guard against insider threats. Partnering with a trusted service provider that can work with you to identify your needs and work through the implementation of the best suited solutions for your organization is the most effective approach to avoiding the pitfalls of this class of threat.