SlideShare una empresa de Scribd logo

EDR vs SIEM - The fight is on

•Descargar como PPTX, PDF•
•
J
Justin Henderson

Many organizations and managed security providers are starting to move from SIEM, Security Information and Event Management, to EDR, Endpoint Detection and Response. The problem is this may not be the best decision for your organization. These technologies are similar but fundamentally different. This presentation also shares innovating ways to use your SIEM to catch the bad guys as well as learn some simple tricks for easing the burden of SIEM management.

Tecnología
1 de 22
SEC555 EDR vs SIEM - Place your best! The fight is on Justin Henderson (GSE # 108) @SecurityMapper Presentation based on SEC555: SIEM with Tactical Analytics
SEC555 | SIEM with Tactical Analytics 2 About Me • Author of SEC555: SIEM with Tactical Analytics • GIAC GSE # 108, Cyber Guardian Blue and Red • 58 industry certifications (need to get a new hobby) • Two time NetWars Core tournament winner (offense) • And security hobbyist and community supporter • Collecting interns/contributors in bulk (research teams) • Release research to the community • See https://github.com/SMAPPER
SEC555 | SIEM with Tactical Analytics 3 Welcome! A copy of this talk is available at: https://github.com/SMAPPER/presentations More free stuff: https://github.com/HASecuritySolutions Disclaimer: This talk represents my personal views not SANS. I do not get money, favors, or items from any EDR or SIEM vendor
SEC555 | SIEM with Tactical Analytics 4 What is EDR? So what is Endpoint Detection and Response (EDR) • Use to be ETDR (Endpoint Threat Detection and Response) Focus is on ENDPOINTS!!! <--- Yay! • Capable of real-time detection • Capable of real-time prevention • Tend to be a one-stop shop for solution • Likely to require an agent (agentless in the works)
SEC555 | SIEM with Tactical Analytics 5 So what really is EDR? Depends on the vendor or open source solution • EDR is the “spirit of providing strong detection and prevention capabilities on endpoints with endpoint data” Vendors achieve this with: • Performing automated analysis at the endpoint • Machine learning (supervised or unsupervised) • Integrating threat intelligence, feeds, and IOCs • Supporting real-time endpoint queries • NG AV functionality + reporting
SEC555 | SIEM with Tactical Analytics 6 EDR Solutions Commercial • Carbon Black • CounterTack • CrowdStrike • Cybereason • FireEye • Tanium • RSA • And more… Open Source – Detection focused • Google Rapid Response • Mozilla InvestiGator • El Jefe • Lima Charlie • OSQuery Kind of: - Sysmon Commercial solutions are stronger
SEC555 | SIEM with Tactical Analytics 7 What is SIEM? SIEM = Security Information and Event Management • Many other acronyms LCE, SEM, SIM Focus is on LOGS / data • Heavy emphasis on detection • Near real-time • Capable of full network and endpoint visibility • Requires multiple moving parts • May or may not require an agent
SEC555 | SIEM with Tactical Analytics 8 SIEM Solutions Commercial • Splunk • Elastic Stack • LogRhythm • HP ArcSight Enterperise Security Manager (ESM) • IBM QRadar • RSA Security Analytics • And more… Open Source • Elastic Stack • Graylog • OSSIM • Prelude • Syslog-NG • Windows Event Collector
SEC555 | SIEM with Tactical Analytics 9 Market Share EDR is growing rapidly • $238 million in sales (2015) vs ~$500 million (2016)1 • Estimated compound annual growth rate of 25%2 • Estimated $2.6 billion dollar growth from 2016 to 20212 SIEM is already massive • Estimated compound annual growth rate of 12%3 • Estimated $5.9 billion dollar market size in 20213 [1] https://blogs.gartner.com/avivah-litan/2017/01/12/booming-500-million-edr-market-faces-stiff-challenges/ [2] http://www.businesswire.com/news/home/20170628006250/en/Endpoint-Detection-Response-Market--- Drivers-Forecasts [3] https://solutionsreview.com/security-information-event-management/siem-market-growth-technavio/
SEC555 | SIEM with Tactical Analytics 10 What are we talking about? EDR - "the apple" Endpoint solution • Agent based • Endpoint data sources • Encryption not an issue Designed for endpoint prevention and analysis • Native prevention capabilities • Strong endpoint detection SIEM - "the banana" Multiple data sources/parts • Likely has agents • Unlimited data sources • Encryption may be issue Pure play analysis / compliance • Capable but typically not used for prevention • Massive detection capabilities
SEC555 | SIEM with Tactical Analytics 11 The Problem Organizations are replacing SIEM with EDR • Some MSSPs are as well These solutions are different • They are complimentary to each other • They are not replacements for each other We as either consumers or security practitioners, need to be aware of this Managed detection and response (MDR) != Managed SIEM
SEC555 | SIEM with Tactical Analytics 12 Advantages of SIEM Total visibility • Simple to correlate between disparate data sources • Context, enrichment capabilities, searching and more • Handle vast amounts of data • Yes… big data but if I call it big data I might throw up
SEC555 | SIEM with Tactical Analytics 13 Disadvantages of SIEM Out of the box situation is horrendous • Default use cases/alerts/pre-built searches can be awful • No logs… no data… nothing Other concerns: • Compliance requirements • High upkeep and maintenance • Log collection (is total visibility required or necessary?) • Staff availability / Training <- most overlooked problem
SEC555 | SIEM with Tactical Analytics 14 Advantages of EDR Default setup provides decent prevention capabilities • And has centralized endpoint reporting capabilities • Has pre-built dashboards and workflows Design allows for modularity • Focus can be on strong prevention with detection • Focus can be on no prevention and 100% detection
SEC555 | SIEM with Tactical Analytics 15 Disadvantages of EDR Requires 100% asset awareness and proper configuration • Required for EDR to do anything Other concerns: • Blind to all non-endpoint data • EDR to EDR varies dramatically • High upkeep and maintenance • Depending on solution may be a black box • Staff availability / Training <- most overlooked problem
SEC555 | SIEM with Tactical Analytics 16 Similar Failures Both EDR and SIEM tend to fail from the same issues • No autopilot • No knowledge of your organization Typically caused by: • Overestimating abilities • Underestimating staffing needs • Training • Time
SEC555 | SIEM with Tactical Analytics 17 Maturity EDR and SIEM require organizational maturity • Security basics should be required before these products SIEM requires proper data sources (firewall, Windows, etc) • And the best detection comes from simple concepts • Like principle of least privilege EDR requires full system deployment and management • And understanding of those systems Domain and organizational expertise MUST BE factored into managed services
SEC555 | SIEM with Tactical Analytics 18 Which is better? A well designed SIEM should outperform EDR in detection • By a long shot • Simpler to slice and dice multiple data sources • More context and supports log enrichment A well designed EDR should outperform SIEM in prevention • Simpler to "react" to events
SEC555 | SIEM with Tactical Analytics 19 So which one do you need? Yes Apple and Banana both are good for you • But depending on your health you may need one over the other (vitamins + minerals) Put plainly you need meat and vegetables more than fruit • So why are we having this conversation?
SEC555 | SIEM with Tactical Analytics 20 Both Require People, Trained People Gartner’s response on EDR (Anton Chuvakin)1 “… there are more skilled network security analysts than … endpoint security analysts” “’focus on the endpoint’ may be a trend, but it does not mean it is operationally feasible for a lot of companies.” Gartner’s response on SIEM (Anton Chuvakin)2 “Your investment in SIEM will be completely, totally, absolutely wasted if you don’t have smart people operating the tool on an ongoing basis” [1] https://blogs.gartner.com/anton-chuvakin/2015/07/23/reality-check-on-edr-etdr/ [2] https://blogs.gartner.com/anton-chuvakin/2012/08/09/on-people-running-siem/
SEC555 | SIEM with Tactical Analytics 21 Use Cases SIEM Organization wishing to have full visibility • Strategic detection • Enrich logs • In-house driven analysis • Compliance requirements • Accept many data sources EDR Focus on endpoint protection • Targeted detection • Automatic vendor driven analysis • Custom tuned prevention • Ability to query endpoint data quickly
SEC555 | SIEM with Tactical Analytics 22 Summary EDR and SIEM = Awesome but not the same • But both require staff training, tuning, and maintenance Both would be ideal • Choose your battle • Live within your budget • Plan to invest significant time EDR or SIEM without staff investment = FAIL

Recomendados

MITRE ATT&CK framework
MITRE ATT&CK frameworkMITRE ATT&CK framework
MITRE ATT&CK frameworkBhushan Gurav
 
Red Team Framework
Red Team FrameworkRed Team Framework
Red Team Framework👀 Joe Gray
 
Endpoint Protection
Endpoint ProtectionEndpoint Protection
Endpoint ProtectionSophos
 
Critical Capabilities for MDR Services - What to Know Before You Buy
Critical Capabilities for MDR Services - What to Know Before You BuyCritical Capabilities for MDR Services - What to Know Before You Buy
Critical Capabilities for MDR Services - What to Know Before You BuyFidelis Cybersecurity
 
MITRE ATT&CK Framework
MITRE ATT&CK FrameworkMITRE ATT&CK Framework
MITRE ATT&CK Frameworkn|u - The Open Security Community
 
Building an InfoSec RedTeam
Building an InfoSec RedTeamBuilding an InfoSec RedTeam
Building an InfoSec RedTeamDan Vasile
 
Security operations center-SOC Presentation-مرکز عملیات امنیت
Security operations center-SOC Presentation-مرکز عملیات امنیتSecurity operations center-SOC Presentation-مرکز عملیات امنیت
Security operations center-SOC Presentation-مرکز عملیات امنیتReZa AdineH
 
Red teaming probably isn't for you
Red teaming probably isn't for youRed teaming probably isn't for you
Red teaming probably isn't for youToby Kohlenberg
 

Recomendados

MITRE ATT&CK framework
MITRE ATT&CK frameworkMITRE ATT&CK framework
MITRE ATT&CK frameworkBhushan Gurav
 
Red Team Framework
Red Team FrameworkRed Team Framework
Red Team Framework👀 Joe Gray
 
Endpoint Protection
Endpoint ProtectionEndpoint Protection
Endpoint ProtectionSophos
 
Critical Capabilities for MDR Services - What to Know Before You Buy
Critical Capabilities for MDR Services - What to Know Before You BuyCritical Capabilities for MDR Services - What to Know Before You Buy
Critical Capabilities for MDR Services - What to Know Before You BuyFidelis Cybersecurity
 
MITRE ATT&CK Framework
MITRE ATT&CK FrameworkMITRE ATT&CK Framework
MITRE ATT&CK Frameworkn|u - The Open Security Community
 
Building an InfoSec RedTeam
Building an InfoSec RedTeamBuilding an InfoSec RedTeam
Building an InfoSec RedTeamDan Vasile
 
Security operations center-SOC Presentation-مرکز عملیات امنیت
Security operations center-SOC Presentation-مرکز عملیات امنیتSecurity operations center-SOC Presentation-مرکز عملیات امنیت
Security operations center-SOC Presentation-مرکز عملیات امنیتReZa AdineH
 
Red teaming probably isn't for you
Red teaming probably isn't for youRed teaming probably isn't for you
Red teaming probably isn't for youToby Kohlenberg
 
NIST cybersecurity framework
NIST cybersecurity frameworkNIST cybersecurity framework
NIST cybersecurity frameworkShriya Rai
 
DTS Solution - Building a SOC (Security Operations Center)
DTS Solution - Building a SOC (Security Operations Center)DTS Solution - Building a SOC (Security Operations Center)
DTS Solution - Building a SOC (Security Operations Center)Shah Sheikh
 
Cyber Threat Hunting Workshop
Cyber Threat Hunting WorkshopCyber Threat Hunting Workshop
Cyber Threat Hunting WorkshopDigit Oktavianto
 
Building a Next-Generation Security Operations Center (SOC)
Building a Next-Generation Security Operations Center (SOC)Building a Next-Generation Security Operations Center (SOC)
Building a Next-Generation Security Operations Center (SOC)Sqrrl
 
Building an effective Information Security Roadmap
Building an effective Information Security RoadmapBuilding an effective Information Security Roadmap
Building an effective Information Security RoadmapElliott Franklin
 
SOC Architecture Workshop - Part 1
SOC Architecture Workshop - Part 1SOC Architecture Workshop - Part 1
SOC Architecture Workshop - Part 1Priyanka Aash
 
Security Operation Center Fundamental
Security Operation Center FundamentalSecurity Operation Center Fundamental
Security Operation Center FundamentalAmir Hossein Zargaran
 
PaloAlto Enterprise Security Solution
PaloAlto Enterprise Security SolutionPaloAlto Enterprise Security Solution
PaloAlto Enterprise Security SolutionPrime Infoserv
 
Red team Engagement
Red team EngagementRed team Engagement
Red team EngagementIndranil Banerjee
 
Beginner's Guide to SIEM
Beginner's Guide to SIEM Beginner's Guide to SIEM
Beginner's Guide to SIEM AlienVault
 
CISSP Chapter 7 - Security Operations
CISSP Chapter 7 - Security OperationsCISSP Chapter 7 - Security Operations
CISSP Chapter 7 - Security OperationsKarthikeyan Dhayalan
 
Threat Hunting
Threat HuntingThreat Hunting
Threat HuntingSplunk
 
Operational Security
Operational SecurityOperational Security
Operational SecuritySplunk
 
Vulnerability and Patch Management
Vulnerability and Patch ManagementVulnerability and Patch Management
Vulnerability and Patch Managementn|u - The Open Security Community
 
Optimizing Security Operations: 5 Keys to Success
Optimizing Security Operations: 5 Keys to SuccessOptimizing Security Operations: 5 Keys to Success
Optimizing Security Operations: 5 Keys to SuccessSirius
 
Next Generation Defense in Depth Model - Tari Schreider, CCISO, Chief Cybers...
Next Generation Defense in Depth Model - Tari Schreider, CCISO, Chief Cybers...Next Generation Defense in Depth Model - Tari Schreider, CCISO, Chief Cybers...
Next Generation Defense in Depth Model - Tari Schreider, CCISO, Chief Cybers...EC-Council
 
Soc and siem and threat hunting
Soc and siem and threat huntingSoc and siem and threat hunting
Soc and siem and threat huntingVikas Jain
 
Security Information and Event Management (SIEM)
Security Information and Event Management (SIEM)Security Information and Event Management (SIEM)
Security Information and Event Management (SIEM)k33a
 
Introduction to MITRE ATT&CK
Introduction to MITRE ATT&CKIntroduction to MITRE ATT&CK
Introduction to MITRE ATT&CKArpan Raval
 
Soc analyst course content
Soc analyst course contentSoc analyst course content
Soc analyst course contentShivamSharma909
 
GCDA - GIAC Certificated Detection Analyst
GCDA - GIAC Certificated Detection AnalystGCDA - GIAC Certificated Detection Analyst
GCDA - GIAC Certificated Detection AnalystJustin Henderson
 
Standard logs made into actionable detects
Standard logs made into actionable detectsStandard logs made into actionable detects
Standard logs made into actionable detectsJustin Henderson
 

Más contenido relacionado

La actualidad más candente

NIST cybersecurity framework
NIST cybersecurity frameworkNIST cybersecurity framework
NIST cybersecurity frameworkShriya Rai
 
DTS Solution - Building a SOC (Security Operations Center)
DTS Solution - Building a SOC (Security Operations Center)DTS Solution - Building a SOC (Security Operations Center)
DTS Solution - Building a SOC (Security Operations Center)Shah Sheikh
 
Cyber Threat Hunting Workshop
Cyber Threat Hunting WorkshopCyber Threat Hunting Workshop
Cyber Threat Hunting WorkshopDigit Oktavianto
 
Building a Next-Generation Security Operations Center (SOC)
Building a Next-Generation Security Operations Center (SOC)Building a Next-Generation Security Operations Center (SOC)
Building a Next-Generation Security Operations Center (SOC)Sqrrl
 
Building an effective Information Security Roadmap
Building an effective Information Security RoadmapBuilding an effective Information Security Roadmap
Building an effective Information Security RoadmapElliott Franklin
 
SOC Architecture Workshop - Part 1
SOC Architecture Workshop - Part 1SOC Architecture Workshop - Part 1
SOC Architecture Workshop - Part 1Priyanka Aash
 
Security Operation Center Fundamental
Security Operation Center FundamentalSecurity Operation Center Fundamental
Security Operation Center FundamentalAmir Hossein Zargaran
 
PaloAlto Enterprise Security Solution
PaloAlto Enterprise Security SolutionPaloAlto Enterprise Security Solution
PaloAlto Enterprise Security SolutionPrime Infoserv
 
Beginner's Guide to SIEM
Beginner's Guide to SIEM Beginner's Guide to SIEM
Beginner's Guide to SIEM AlienVault
 
CISSP Chapter 7 - Security Operations
CISSP Chapter 7 - Security OperationsCISSP Chapter 7 - Security Operations
CISSP Chapter 7 - Security OperationsKarthikeyan Dhayalan
 
Threat Hunting
Threat HuntingThreat Hunting
Threat HuntingSplunk
 
Operational Security
Operational SecurityOperational Security
Operational SecuritySplunk
 
Optimizing Security Operations: 5 Keys to Success
Optimizing Security Operations: 5 Keys to SuccessOptimizing Security Operations: 5 Keys to Success
Optimizing Security Operations: 5 Keys to SuccessSirius
 
Next Generation Defense in Depth Model - Tari Schreider, CCISO, Chief Cybers...
Next Generation Defense in Depth Model - Tari Schreider, CCISO, Chief Cybers...Next Generation Defense in Depth Model - Tari Schreider, CCISO, Chief Cybers...
Next Generation Defense in Depth Model - Tari Schreider, CCISO, Chief Cybers...EC-Council
 
Soc and siem and threat hunting
Soc and siem and threat huntingSoc and siem and threat hunting
Soc and siem and threat huntingVikas Jain
 
Security Information and Event Management (SIEM)
Security Information and Event Management (SIEM)Security Information and Event Management (SIEM)
Security Information and Event Management (SIEM)k33a
 
Introduction to MITRE ATT&CK
Introduction to MITRE ATT&CKIntroduction to MITRE ATT&CK
Introduction to MITRE ATT&CKArpan Raval
 
Soc analyst course content
Soc analyst course contentSoc analyst course content
Soc analyst course contentShivamSharma909
 

La actualidad más candente (20)

NIST cybersecurity framework
NIST cybersecurity frameworkNIST cybersecurity framework
NIST cybersecurity framework
 
DTS Solution - Building a SOC (Security Operations Center)
DTS Solution - Building a SOC (Security Operations Center)DTS Solution - Building a SOC (Security Operations Center)
DTS Solution - Building a SOC (Security Operations Center)
 
Cyber Threat Hunting Workshop
Cyber Threat Hunting WorkshopCyber Threat Hunting Workshop
Cyber Threat Hunting Workshop
 
Building a Next-Generation Security Operations Center (SOC)
Building a Next-Generation Security Operations Center (SOC)Building a Next-Generation Security Operations Center (SOC)
Building a Next-Generation Security Operations Center (SOC)
 
Building an effective Information Security Roadmap
Building an effective Information Security RoadmapBuilding an effective Information Security Roadmap
Building an effective Information Security Roadmap
 
SOC Architecture Workshop - Part 1
SOC Architecture Workshop - Part 1SOC Architecture Workshop - Part 1
SOC Architecture Workshop - Part 1
 
Security Operation Center Fundamental
Security Operation Center FundamentalSecurity Operation Center Fundamental
Security Operation Center Fundamental
 
PaloAlto Enterprise Security Solution
PaloAlto Enterprise Security SolutionPaloAlto Enterprise Security Solution
PaloAlto Enterprise Security Solution
 
Red team Engagement
Red team EngagementRed team Engagement
Red team Engagement
 
Beginner's Guide to SIEM
Beginner's Guide to SIEM Beginner's Guide to SIEM
Beginner's Guide to SIEM
 
CISSP Chapter 7 - Security Operations
CISSP Chapter 7 - Security OperationsCISSP Chapter 7 - Security Operations
CISSP Chapter 7 - Security Operations
 
Threat Hunting
Threat HuntingThreat Hunting
Threat Hunting
 
Operational Security
Operational SecurityOperational Security
Operational Security
 
Vulnerability and Patch Management
Vulnerability and Patch ManagementVulnerability and Patch Management
Vulnerability and Patch Management
 
Optimizing Security Operations: 5 Keys to Success
Optimizing Security Operations: 5 Keys to SuccessOptimizing Security Operations: 5 Keys to Success
Optimizing Security Operations: 5 Keys to Success
 
Next Generation Defense in Depth Model - Tari Schreider, CCISO, Chief Cybers...
Next Generation Defense in Depth Model - Tari Schreider, CCISO, Chief Cybers...Next Generation Defense in Depth Model - Tari Schreider, CCISO, Chief Cybers...
Next Generation Defense in Depth Model - Tari Schreider, CCISO, Chief Cybers...
 
Soc and siem and threat hunting
Soc and siem and threat huntingSoc and siem and threat hunting
Soc and siem and threat hunting
 
Security Information and Event Management (SIEM)
Security Information and Event Management (SIEM)Security Information and Event Management (SIEM)
Security Information and Event Management (SIEM)
 
Introduction to MITRE ATT&CK
Introduction to MITRE ATT&CKIntroduction to MITRE ATT&CK
Introduction to MITRE ATT&CK
 
Soc analyst course content
Soc analyst course contentSoc analyst course content
Soc analyst course content
 

Similar a EDR vs SIEM - The fight is on

GCDA - GIAC Certificated Detection Analyst
GCDA - GIAC Certificated Detection AnalystGCDA - GIAC Certificated Detection Analyst
GCDA - GIAC Certificated Detection AnalystJustin Henderson
 
Standard logs made into actionable detects
Standard logs made into actionable detectsStandard logs made into actionable detects
Standard logs made into actionable detectsJustin Henderson
 
Understanding Zero Trust Security for IBM i
Understanding Zero Trust Security for IBM iUnderstanding Zero Trust Security for IBM i
Understanding Zero Trust Security for IBM iPrecisely
 
Detecting modern PowerShell attacks with SIEM
Detecting modern PowerShell attacks with SIEMDetecting modern PowerShell attacks with SIEM
Detecting modern PowerShell attacks with SIEMJustin Henderson
 
12 Simple Cybersecurity Rules For Your Small Business
12 Simple Cybersecurity Rules For Your Small Business 12 Simple Cybersecurity Rules For Your Small Business
12 Simple Cybersecurity Rules For Your Small Business NSUGSCIS
 
BSIMM: Bringing Science to Software Security
BSIMM: Bringing Science to Software SecurityBSIMM: Bringing Science to Software Security
BSIMM: Bringing Science to Software SecurityCigital
 
Aligning Application Security to Compliance
Aligning Application Security to ComplianceAligning Application Security to Compliance
Aligning Application Security to ComplianceSecurity Innovation
 
The SIEM Buyer Guide the siem buyer guide
The SIEM Buyer Guide the siem buyer guideThe SIEM Buyer Guide the siem buyer guide
The SIEM Buyer Guide the siem buyer guideroongrus
 
Security Training: Making your weakest link the strongest - CircleCityCon 2017
Security Training: Making your weakest link the strongest - CircleCityCon 2017Security Training: Making your weakest link the strongest - CircleCityCon 2017
Security Training: Making your weakest link the strongest - CircleCityCon 2017Aaron Hnatiw
 
Cloud Security Zen: Principles to Meditate On
Cloud Security Zen: Principles to Meditate OnCloud Security Zen: Principles to Meditate On
Cloud Security Zen: Principles to Meditate OnSamuel Reed
 
Secure Storage Encryption Implications_Fornetix
Secure Storage Encryption Implications_FornetixSecure Storage Encryption Implications_Fornetix
Secure Storage Encryption Implications_FornetixBob Guimarin
 
Security Outsourcing - Couples Counseling - Atif Ghauri
Security Outsourcing - Couples Counseling - Atif GhauriSecurity Outsourcing - Couples Counseling - Atif Ghauri
Security Outsourcing - Couples Counseling - Atif GhauriAtif Ghauri
 
Don’t Just Trust Cloud Providers - How To Audit Cloud Providers
Don’t Just Trust Cloud Providers - How To Audit Cloud ProvidersDon’t Just Trust Cloud Providers - How To Audit Cloud Providers
Don’t Just Trust Cloud Providers - How To Audit Cloud ProvidersMichael Davis
 
NZISF Talk: Six essential security services
NZISF Talk: Six essential security servicesNZISF Talk: Six essential security services
NZISF Talk: Six essential security servicesHinne Hettema
 
Application Security within Agile
Application Security within AgileApplication Security within Agile
Application Security within AgileNetlight Consulting
 
BUSCAS UNA SEGURIDAD INTEGRADA Y DINÁMICA? ; INTELIGENCIA Y COLABORACIÓN LA ...
BUSCAS UNA SEGURIDAD INTEGRADA Y DINÁMICA? ; INTELIGENCIA Y COLABORACIÓN LA ...BUSCAS UNA SEGURIDAD INTEGRADA Y DINÁMICA? ; INTELIGENCIA Y COLABORACIÓN LA ...
BUSCAS UNA SEGURIDAD INTEGRADA Y DINÁMICA? ; INTELIGENCIA Y COLABORACIÓN LA ...Cristian Garcia G.
 

Similar a EDR vs SIEM - The fight is on (20)

GCDA - GIAC Certificated Detection Analyst
GCDA - GIAC Certificated Detection AnalystGCDA - GIAC Certificated Detection Analyst
GCDA - GIAC Certificated Detection Analyst
 
Standard logs made into actionable detects
Standard logs made into actionable detectsStandard logs made into actionable detects
Standard logs made into actionable detects
 
Understanding Zero Trust Security for IBM i
Understanding Zero Trust Security for IBM iUnderstanding Zero Trust Security for IBM i
Understanding Zero Trust Security for IBM i
 
Detecting modern PowerShell attacks with SIEM
Detecting modern PowerShell attacks with SIEMDetecting modern PowerShell attacks with SIEM
Detecting modern PowerShell attacks with SIEM
 
12 Simple Cybersecurity Rules For Your Small Business
12 Simple Cybersecurity Rules For Your Small Business 12 Simple Cybersecurity Rules For Your Small Business
12 Simple Cybersecurity Rules For Your Small Business
 
BSIMM: Bringing Science to Software Security
BSIMM: Bringing Science to Software SecurityBSIMM: Bringing Science to Software Security
BSIMM: Bringing Science to Software Security
 
SORT OUT YOUR SIEM
SORT OUT YOUR SIEMSORT OUT YOUR SIEM
SORT OUT YOUR SIEM
 
Aligning Application Security to Compliance
Aligning Application Security to ComplianceAligning Application Security to Compliance
Aligning Application Security to Compliance
 
The SIEM Buyer Guide the siem buyer guide
The SIEM Buyer Guide the siem buyer guideThe SIEM Buyer Guide the siem buyer guide
The SIEM Buyer Guide the siem buyer guide
 
Security Training: Making your weakest link the strongest - CircleCityCon 2017
Security Training: Making your weakest link the strongest - CircleCityCon 2017Security Training: Making your weakest link the strongest - CircleCityCon 2017
Security Training: Making your weakest link the strongest - CircleCityCon 2017
 
Cloud Security Zen: Principles to Meditate On
Cloud Security Zen: Principles to Meditate OnCloud Security Zen: Principles to Meditate On
Cloud Security Zen: Principles to Meditate On
 
Secure Storage Encryption Implications_Fornetix
Secure Storage Encryption Implications_FornetixSecure Storage Encryption Implications_Fornetix
Secure Storage Encryption Implications_Fornetix
 
Security Outsourcing - Couples Counseling - Atif Ghauri
Security Outsourcing - Couples Counseling - Atif GhauriSecurity Outsourcing - Couples Counseling - Atif Ghauri
Security Outsourcing - Couples Counseling - Atif Ghauri
 
SIEM - Your Complete IT Security Arsenal
SIEM - Your Complete IT Security ArsenalSIEM - Your Complete IT Security Arsenal
SIEM - Your Complete IT Security Arsenal
 
IT Security Strategy
IT Security StrategyIT Security Strategy
IT Security Strategy
 
IT Security Strategy
IT Security StrategyIT Security Strategy
IT Security Strategy
 
Don’t Just Trust Cloud Providers - How To Audit Cloud Providers
Don’t Just Trust Cloud Providers - How To Audit Cloud ProvidersDon’t Just Trust Cloud Providers - How To Audit Cloud Providers
Don’t Just Trust Cloud Providers - How To Audit Cloud Providers
 
NZISF Talk: Six essential security services
NZISF Talk: Six essential security servicesNZISF Talk: Six essential security services
NZISF Talk: Six essential security services
 
Application Security within Agile
Application Security within AgileApplication Security within Agile
Application Security within Agile
 
BUSCAS UNA SEGURIDAD INTEGRADA Y DINÁMICA? ; INTELIGENCIA Y COLABORACIÓN LA ...
BUSCAS UNA SEGURIDAD INTEGRADA Y DINÁMICA? ; INTELIGENCIA Y COLABORACIÓN LA ...BUSCAS UNA SEGURIDAD INTEGRADA Y DINÁMICA? ; INTELIGENCIA Y COLABORACIÓN LA ...
BUSCAS UNA SEGURIDAD INTEGRADA Y DINÁMICA? ; INTELIGENCIA Y COLABORACIÓN LA ...
 

Último

AWS Community Day CPH - Three problems of Terraform
AWS Community Day CPH - Three problems of TerraformAWS Community Day CPH - Three problems of Terraform
AWS Community Day CPH - Three problems of TerraformAndrey Devyatkin
 
"I see eyes in my soup": How Delivery Hero implemented the safety system for ...
"I see eyes in my soup": How Delivery Hero implemented the safety system for ..."I see eyes in my soup": How Delivery Hero implemented the safety system for ...
"I see eyes in my soup": How Delivery Hero implemented the safety system for ...Zilliz
 
Navigating the Deluge_ Dubai Floods and the Resilience of Dubai International...
Navigating the Deluge_ Dubai Floods and the Resilience of Dubai International...Navigating the Deluge_ Dubai Floods and the Resilience of Dubai International...
Navigating the Deluge_ Dubai Floods and the Resilience of Dubai International...Orbitshub
 
Cyberprint. Dark Pink Apt Group [EN].pdf
Cyberprint. Dark Pink Apt Group [EN].pdfCyberprint. Dark Pink Apt Group [EN].pdf
Cyberprint. Dark Pink Apt Group [EN].pdfOverkill Security
 
DEV meet-up UiPath Document Understanding May 7 2024 Amsterdam
DEV meet-up UiPath Document Understanding May 7 2024 AmsterdamDEV meet-up UiPath Document Understanding May 7 2024 Amsterdam
DEV meet-up UiPath Document Understanding May 7 2024 AmsterdamUiPathCommunity
 
Boost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdfBoost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdfsudhanshuwaghmare1
 
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data DiscoveryTrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data DiscoveryTrustArc
 
Polkadot JAM Slides - Token2049 - By Dr. Gavin Wood
Polkadot JAM Slides - Token2049 - By Dr. Gavin WoodPolkadot JAM Slides - Token2049 - By Dr. Gavin Wood
Polkadot JAM Slides - Token2049 - By Dr. Gavin WoodJuan lago vázquez
 
Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...apidays
 
Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...
Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...
Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...apidays
 
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot TakeoffStrategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoffsammart93
 
Corporate and higher education May webinar.pptx
Corporate and higher education May webinar.pptxCorporate and higher education May webinar.pptx
Corporate and higher education May webinar.pptxRustici Software
 
Strategies for Landing an Oracle DBA Job as a Fresher
Strategies for Landing an Oracle DBA Job as a FresherStrategies for Landing an Oracle DBA Job as a Fresher
Strategies for Landing an Oracle DBA Job as a FresherRemote DBA Services
 
Spring Boot vs Quarkus the ultimate battle - DevoxxUK
Spring Boot vs Quarkus the ultimate battle - DevoxxUKSpring Boot vs Quarkus the ultimate battle - DevoxxUK
Spring Boot vs Quarkus the ultimate battle - DevoxxUKJago de Vreede
 
AXA XL - Insurer Innovation Award Americas 2024
AXA XL - Insurer Innovation Award Americas 2024AXA XL - Insurer Innovation Award Americas 2024
AXA XL - Insurer Innovation Award Americas 2024The Digital Insurer
 
Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving
Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost SavingRepurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving
Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost SavingEdi Saputra
 
Finding Java's Hidden Performance Traps @ DevoxxUK 2024
Finding Java's Hidden Performance Traps @ DevoxxUK 2024Finding Java's Hidden Performance Traps @ DevoxxUK 2024
Finding Java's Hidden Performance Traps @ DevoxxUK 2024Victor Rentea
 
Exploring Multimodal Embeddings with Milvus
Exploring Multimodal Embeddings with MilvusExploring Multimodal Embeddings with Milvus
Exploring Multimodal Embeddings with MilvusZilliz
 
Why Teams call analytics are critical to your entire business
Why Teams call analytics are critical to your entire businessWhy Teams call analytics are critical to your entire business
Why Teams call analytics are critical to your entire businesspanagenda
 
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FMECloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FMESafe Software
 

Último (20)

AWS Community Day CPH - Three problems of Terraform
AWS Community Day CPH - Three problems of TerraformAWS Community Day CPH - Three problems of Terraform
AWS Community Day CPH - Three problems of Terraform
 
"I see eyes in my soup": How Delivery Hero implemented the safety system for ...
"I see eyes in my soup": How Delivery Hero implemented the safety system for ..."I see eyes in my soup": How Delivery Hero implemented the safety system for ...
"I see eyes in my soup": How Delivery Hero implemented the safety system for ...
 
Navigating the Deluge_ Dubai Floods and the Resilience of Dubai International...
Navigating the Deluge_ Dubai Floods and the Resilience of Dubai International...Navigating the Deluge_ Dubai Floods and the Resilience of Dubai International...
Navigating the Deluge_ Dubai Floods and the Resilience of Dubai International...
 
Cyberprint. Dark Pink Apt Group [EN].pdf
Cyberprint. Dark Pink Apt Group [EN].pdfCyberprint. Dark Pink Apt Group [EN].pdf
Cyberprint. Dark Pink Apt Group [EN].pdf
 
DEV meet-up UiPath Document Understanding May 7 2024 Amsterdam
DEV meet-up UiPath Document Understanding May 7 2024 AmsterdamDEV meet-up UiPath Document Understanding May 7 2024 Amsterdam
DEV meet-up UiPath Document Understanding May 7 2024 Amsterdam
 
Boost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdfBoost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdf
 
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data DiscoveryTrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
 
Polkadot JAM Slides - Token2049 - By Dr. Gavin Wood
Polkadot JAM Slides - Token2049 - By Dr. Gavin WoodPolkadot JAM Slides - Token2049 - By Dr. Gavin Wood
Polkadot JAM Slides - Token2049 - By Dr. Gavin Wood
 
Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...
 
Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...
Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...
Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...
 
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot TakeoffStrategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
 
Corporate and higher education May webinar.pptx
Corporate and higher education May webinar.pptxCorporate and higher education May webinar.pptx
Corporate and higher education May webinar.pptx
 
Strategies for Landing an Oracle DBA Job as a Fresher
Strategies for Landing an Oracle DBA Job as a FresherStrategies for Landing an Oracle DBA Job as a Fresher
Strategies for Landing an Oracle DBA Job as a Fresher
 
Spring Boot vs Quarkus the ultimate battle - DevoxxUK
Spring Boot vs Quarkus the ultimate battle - DevoxxUKSpring Boot vs Quarkus the ultimate battle - DevoxxUK
Spring Boot vs Quarkus the ultimate battle - DevoxxUK
 
AXA XL - Insurer Innovation Award Americas 2024
AXA XL - Insurer Innovation Award Americas 2024AXA XL - Insurer Innovation Award Americas 2024
AXA XL - Insurer Innovation Award Americas 2024
 
Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving
Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost SavingRepurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving
Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving
 
Finding Java's Hidden Performance Traps @ DevoxxUK 2024
Finding Java's Hidden Performance Traps @ DevoxxUK 2024Finding Java's Hidden Performance Traps @ DevoxxUK 2024
Finding Java's Hidden Performance Traps @ DevoxxUK 2024
 
Exploring Multimodal Embeddings with Milvus
Exploring Multimodal Embeddings with MilvusExploring Multimodal Embeddings with Milvus
Exploring Multimodal Embeddings with Milvus
 
Why Teams call analytics are critical to your entire business
Why Teams call analytics are critical to your entire businessWhy Teams call analytics are critical to your entire business
Why Teams call analytics are critical to your entire business
 
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FMECloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
 

EDR vs SIEM - The fight is on

  • 1. SEC555 EDR vs SIEM - Place your best! The fight is on Justin Henderson (GSE # 108) @SecurityMapper Presentation based on SEC555: SIEM with Tactical Analytics
  • 2. SEC555 | SIEM with Tactical Analytics 2 About Me • Author of SEC555: SIEM with Tactical Analytics • GIAC GSE # 108, Cyber Guardian Blue and Red • 58 industry certifications (need to get a new hobby) • Two time NetWars Core tournament winner (offense) • And security hobbyist and community supporter • Collecting interns/contributors in bulk (research teams) • Release research to the community • See https://github.com/SMAPPER
  • 3. SEC555 | SIEM with Tactical Analytics 3 Welcome! A copy of this talk is available at: https://github.com/SMAPPER/presentations More free stuff: https://github.com/HASecuritySolutions Disclaimer: This talk represents my personal views not SANS. I do not get money, favors, or items from any EDR or SIEM vendor
  • 4. SEC555 | SIEM with Tactical Analytics 4 What is EDR? So what is Endpoint Detection and Response (EDR) • Use to be ETDR (Endpoint Threat Detection and Response) Focus is on ENDPOINTS!!! <--- Yay! • Capable of real-time detection • Capable of real-time prevention • Tend to be a one-stop shop for solution • Likely to require an agent (agentless in the works)
  • 5. SEC555 | SIEM with Tactical Analytics 5 So what really is EDR? Depends on the vendor or open source solution • EDR is the “spirit of providing strong detection and prevention capabilities on endpoints with endpoint data” Vendors achieve this with: • Performing automated analysis at the endpoint • Machine learning (supervised or unsupervised) • Integrating threat intelligence, feeds, and IOCs • Supporting real-time endpoint queries • NG AV functionality + reporting
  • 6. SEC555 | SIEM with Tactical Analytics 6 EDR Solutions Commercial • Carbon Black • CounterTack • CrowdStrike • Cybereason • FireEye • Tanium • RSA • And more… Open Source – Detection focused • Google Rapid Response • Mozilla InvestiGator • El Jefe • Lima Charlie • OSQuery Kind of: - Sysmon Commercial solutions are stronger
  • 7. SEC555 | SIEM with Tactical Analytics 7 What is SIEM? SIEM = Security Information and Event Management • Many other acronyms LCE, SEM, SIM Focus is on LOGS / data • Heavy emphasis on detection • Near real-time • Capable of full network and endpoint visibility • Requires multiple moving parts • May or may not require an agent
  • 8. SEC555 | SIEM with Tactical Analytics 8 SIEM Solutions Commercial • Splunk • Elastic Stack • LogRhythm • HP ArcSight Enterperise Security Manager (ESM) • IBM QRadar • RSA Security Analytics • And more… Open Source • Elastic Stack • Graylog • OSSIM • Prelude • Syslog-NG • Windows Event Collector
  • 9. SEC555 | SIEM with Tactical Analytics 9 Market Share EDR is growing rapidly • $238 million in sales (2015) vs ~$500 million (2016)1 • Estimated compound annual growth rate of 25%2 • Estimated $2.6 billion dollar growth from 2016 to 20212 SIEM is already massive • Estimated compound annual growth rate of 12%3 • Estimated $5.9 billion dollar market size in 20213 [1] https://blogs.gartner.com/avivah-litan/2017/01/12/booming-500-million-edr-market-faces-stiff-challenges/ [2] http://www.businesswire.com/news/home/20170628006250/en/Endpoint-Detection-Response-Market--- Drivers-Forecasts [3] https://solutionsreview.com/security-information-event-management/siem-market-growth-technavio/
  • 10. SEC555 | SIEM with Tactical Analytics 10 What are we talking about? EDR - "the apple" Endpoint solution • Agent based • Endpoint data sources • Encryption not an issue Designed for endpoint prevention and analysis • Native prevention capabilities • Strong endpoint detection SIEM - "the banana" Multiple data sources/parts • Likely has agents • Unlimited data sources • Encryption may be issue Pure play analysis / compliance • Capable but typically not used for prevention • Massive detection capabilities
  • 11. SEC555 | SIEM with Tactical Analytics 11 The Problem Organizations are replacing SIEM with EDR • Some MSSPs are as well These solutions are different • They are complimentary to each other • They are not replacements for each other We as either consumers or security practitioners, need to be aware of this Managed detection and response (MDR) != Managed SIEM
  • 12. SEC555 | SIEM with Tactical Analytics 12 Advantages of SIEM Total visibility • Simple to correlate between disparate data sources • Context, enrichment capabilities, searching and more • Handle vast amounts of data • Yes… big data but if I call it big data I might throw up
  • 13. SEC555 | SIEM with Tactical Analytics 13 Disadvantages of SIEM Out of the box situation is horrendous • Default use cases/alerts/pre-built searches can be awful • No logs… no data… nothing Other concerns: • Compliance requirements • High upkeep and maintenance • Log collection (is total visibility required or necessary?) • Staff availability / Training <- most overlooked problem
  • 14. SEC555 | SIEM with Tactical Analytics 14 Advantages of EDR Default setup provides decent prevention capabilities • And has centralized endpoint reporting capabilities • Has pre-built dashboards and workflows Design allows for modularity • Focus can be on strong prevention with detection • Focus can be on no prevention and 100% detection
  • 15. SEC555 | SIEM with Tactical Analytics 15 Disadvantages of EDR Requires 100% asset awareness and proper configuration • Required for EDR to do anything Other concerns: • Blind to all non-endpoint data • EDR to EDR varies dramatically • High upkeep and maintenance • Depending on solution may be a black box • Staff availability / Training <- most overlooked problem
  • 16. SEC555 | SIEM with Tactical Analytics 16 Similar Failures Both EDR and SIEM tend to fail from the same issues • No autopilot • No knowledge of your organization Typically caused by: • Overestimating abilities • Underestimating staffing needs • Training • Time
  • 17. SEC555 | SIEM with Tactical Analytics 17 Maturity EDR and SIEM require organizational maturity • Security basics should be required before these products SIEM requires proper data sources (firewall, Windows, etc) • And the best detection comes from simple concepts • Like principle of least privilege EDR requires full system deployment and management • And understanding of those systems Domain and organizational expertise MUST BE factored into managed services
  • 18. SEC555 | SIEM with Tactical Analytics 18 Which is better? A well designed SIEM should outperform EDR in detection • By a long shot • Simpler to slice and dice multiple data sources • More context and supports log enrichment A well designed EDR should outperform SIEM in prevention • Simpler to "react" to events
  • 19. SEC555 | SIEM with Tactical Analytics 19 So which one do you need? Yes Apple and Banana both are good for you • But depending on your health you may need one over the other (vitamins + minerals) Put plainly you need meat and vegetables more than fruit • So why are we having this conversation?
  • 20. SEC555 | SIEM with Tactical Analytics 20 Both Require People, Trained People Gartner’s response on EDR (Anton Chuvakin)1 “… there are more skilled network security analysts than … endpoint security analysts” “’focus on the endpoint’ may be a trend, but it does not mean it is operationally feasible for a lot of companies.” Gartner’s response on SIEM (Anton Chuvakin)2 “Your investment in SIEM will be completely, totally, absolutely wasted if you don’t have smart people operating the tool on an ongoing basis” [1] https://blogs.gartner.com/anton-chuvakin/2015/07/23/reality-check-on-edr-etdr/ [2] https://blogs.gartner.com/anton-chuvakin/2012/08/09/on-people-running-siem/
  • 21. SEC555 | SIEM with Tactical Analytics 21 Use Cases SIEM Organization wishing to have full visibility • Strategic detection • Enrich logs • In-house driven analysis • Compliance requirements • Accept many data sources EDR Focus on endpoint protection • Targeted detection • Automatic vendor driven analysis • Custom tuned prevention • Ability to query endpoint data quickly
  • 22. SEC555 | SIEM with Tactical Analytics 22 Summary EDR and SIEM = Awesome but not the same • But both require staff training, tuning, and maintenance Both would be ideal • Choose your battle • Live within your budget • Plan to invest significant time EDR or SIEM without staff investment = FAIL