Integra Customer Presentation

1. Copyright © 2014 Splunk Inc.
Providing First-Rate
Security Services With
AnalyCcs-Driven Security
Stephen Fisher, CISO
Integra

2. About Integra
! Integra is one of the largest regional faciliCes-based providers of carrier-
grade networking, communicaCons and technology soluCons in the
western United States. Through our business units, Electric Lightwave
and Integra Business, we provide criCcal connecCvity, Unified
CommunicaCons, managed and cloud services, and security services to
domesCc and internaConal customers, including large enterprises,
government customers, wholesale customers and regional business
customers.

3. Challenges We Faced
! Wide Range of Security Requirements
– Internal audits (Financial, PCI)
– Contractual security program requirements with customers
– Internal informaCon and asset protecCon
– Security products (Cloud Firewall/DDoS)
! Cultural and OrganizaConal Challenges
– Security not a priority for everyone
– Outsourced security operaCons
– Limited resources
– Data not available for security operaCons
ê InformaCon hoarders and data silos

4. Mission:
ü Create security program valuing transparency, accountability and oversight
ü Ensure the success of the company’s mission
ü Support the missions of our customers
Create a comprehensive balanced informaCon security program with
management, operaConal and technical security controls.
ü Secure Integra’s informaCon/assets
ü Enable security products to be secure
An AmbiCous Goal

5. Our Plan to Cross the Chasm
• Build a SOC in eight months
• Buy the right tools and implement
the ones we have!
• Break down the silos
• Don’t just idenCfy problems –
solve them
• Don’t repeat past mistakes

6. Build a SOC in 8 Months
6
+ Why we insourced a SOC
Needed to change the culture
Needed control to get things done
Needed a evangelist for security
+ Building the SOC
+ Find a locaCon
+ Procure & setup SIEM infrastructure
+ Redirect all logs to SIEM
+ Re-allocate resources
+ Hire addiConal staff
+ Train staff
+ Define SOC incident response
policies and procedures
+ TransiCon from outsourced SOC

7. Buy the Right Tools – We Chose Splunk
! Meets all of our requirements:
– Supports our security and non-security needs
– Provides visibility across the organizaCon
– Delivers immediate value
– Meets our longer term goals to be proacCve and predicCve
! Solves many organizaConal challenges:
– Gives the organizaCon a reason to care (break the silos)
– Increases visibility sold them on insourcing
– Fast Cme to value and low TCO jusCfies the investment
7

8. Break Down the Silos
! Support the needs of individual stakeholders
! Show them a beder place to put their data
! Solve their use cases
! Sell the value of sharing!

9. Splunk Engagement & Architecture
Engaged Splunk Professional Services:
• Interview key stake holders (data owners)
• IdenCfy and prioriCze the data sources
• Document findings in a priority matrix
• Deliver an overall architecture
All Virtualized – RHEV with RHEL
9
10 Heavy Forwarders
1 SNMP Forwarder
1 NetApp VM Ware Forwarder
7 Indexers
1 Search Head Cluster (3 Search Heads) +
2 User Specific Search Heads + 1 Deployment Server
1 Enterprise Security Search Head

10. Use Case #1
Security Challenge:
! DetecCon and response to possible
brute force adacks
– Check for brute force paderns from logon events
ê AcCve Directory
ê Win: Security logs
ê Cisco Secure ACS logs
ê Unix authenCcaCon logs
How Splunk Helped:
! Facilitated rapid detecCon and
deep invesCgaCon
– Enabled SecOps to detect the adempts
– Provided substanCal forensic data
ê Determined source of the adack
ê IdenCfied compromised systems
10

11. Use Case #2
Security Challenge:
! DetecCon and response to web applicaCon
security
– Aggregate and correlate logs from web
applicaCon systems
ê WAF
ê SQL servers
ê web servers
How Splunk Helped:
! Enabled detecCon of potenCal web
applicaCon adacks
– SQL injecCon
– Cross site scripCng
– Buffer overflow adempts
11

12. Use Case #3
Security Challenge:
! DetecCon of suspicious behavior from log
sources
– CorrelaCon of organizaCon-wide machine data
– Analysis of security and non-security data
How Splunk Helped:
! Discovered compromised JetDirect cards
– Able to index, correlate and analyze data from all
device types
– Rapidly discovered common paderns and trends
12

13. Use Case #4
Security Challenge:
! DetecCon and response to malware
– AnC-malware alone is insufficient
How Splunk Helped:
! Able to ingest and correlate all log
data – from perimeter to endpoints
– Enabled rapid malware detecCon
– Facilitated rapid threat miCgaCon
13

14. Key Takeaways
! Engage and enable the business
! Create a balanced informaCon security program
! Employ a solid foundaCon of security
controls first
! Don’t be overwhelmed – take one step at a Cme
! Create security program valuing transparency,
accountability & oversight
! Remove the limits of outsourced
security operaCons
14