Protecting health and life science organizations from breaches and ransomware

1© Cloudera, Inc. All rights reserved.
| |
Protecting health and life science
organizations from breaches and ransomware
With big data-based machine learning and UBA solutions
| |

| |
Agenda for Today’s Webinar
• Introduction
• Breach Security Assessments for HLS Organizations
• Industry Overview
• Behavioral Analytics
• Q&A

| |
Today’s Speakers
Karthik Krishnan
Vice President,
Product Management
Rocky DeStefano
Cybersecurity
Subject Matter Expert
David Houlding
Director of Healthcare
Privacy and Security
Intel Health and Life Sciences

| |
Breach Security Assessments for
HLS Organizations

Intel Health & Life Sciences | Make it Personal
Healthcare Security – Increasingly About Survival
• Severe impact of breaches
• Compliance necessary
• Not sufficient to adequately
mitigate risk of breaches
• How far do you have to go?
• Don’t be at the
“back of the herd”
• How does your security
compare?
• How can you measure your breach security against the industry?
5

Breach Security Capabilities Maturity Model
Improved Breach Security, Usability, Cost, IT Operations
Enhanced
+ Device control
+ Penetration testing / vulnerability scan
+ Client Solid State Drive (encrypted)
+ Endpoint Data Loss Prevention
+ Network Data Loss Prevention (monitoring,
capture)
+ Anti-theft: remote locate, lock, wipe
+ Multi-factor authentication w timeout
+ Secure remote administration
+ Policy based encryption for files and folders
+ Server / database / backup encryption
+ Network segmentation
+ Network Intrusion Prevention System
+ Business associate agreements
+ Virtualization
Advanced
+ Server Solid State Drive (encrypted)
+ Network Data Loss Prevention
(prevention)
+ Database activity monitoring
+ Digital forensics
+ Security Information and Event
Management
+ Threat intelligence
+ Multi-factor authentication with walk-
away lock
+ Client Application Whitelisting
+ Server Application Whitelisting
+ De-identification / anonymization
+ Tokenization
+ Business Continuity and Disaster
Recovery
Baseline
+ Policy
+ Risk assessment
+ Audit and compliance
+ User training
+ Endpoint device encryption
+ Mobile device management
+ Data Loss Prevention (discovery)
+ Anti-malware
+ IAM, Single factor access control
+ Firewall
+ Email gateway
+ Web gateway
+ Vulnerability management, patching
+ Security incident response plan
+ Secure Disposal
+ Backup and Restore
6

| |
POLLING QUESTION – TO USE READYTALK’S POLLING FEATURE
What type of breach are you most concerned about?
· Ransomware
· Cybercrime Hacking
· Loss or Theft of Mobile Device or Media
· Insider Accidents or Workarounds
· Business Associates
· Malicious Insiders or Fraud
· Insider Snooping
· Improper Disposal

HLS Breach Security Priorities
Global Industry Report
8
• Priorities / levels of concern across 8 types of breaches, including ransomware
• Roughly mirrors allocation
of resources and budget
to mitigate risks
• Statistics on readiness of
organizations for each type
of breach
• Percentage of relevant
security capabilities
implemented
Intel.com/BreachSecurity

HLS Breach Security
Capabilities
Global Industry Report
9
• 42 security capabilities
• Administrative, physical
and technical safeguards
• Percentage of capability
implemented across Health
& Life Sciences
organizations assessed

Security Incident Response Plan
Global Health & Life Sciences Results
Plans in place
covering what do to in
the event of a
suspected data
security incident or
breach.
10

Threat Intelligence
• Acquisition and sharing of
threats, vulnerabilities
• Reputation
• Static or dynamic analysis
• Behavioral analytics
11

Digital Forensics
Ability to conduct forensic
analysis of IT infrastructure,
often in the event of a
suspected security incident,
to detect unauthorized
access to sensitive patient
information and establish
whether breach occurred
and if so characteristics
such as timing and extent.
12

Intel Health & Life Sciences | Make it Personal Intel Confidential – Do Not Forward
Hardware Enhanced Security
13
Security
Software
General Purpose
Hardware
Separate Security
Hardware
Security
Software
Core
Security Logic
General Purpose
Hardware
Core
Security Logic
Core
Security Logic
Trend
Performance,
Robustness,
Usability, Cost
Better
Time
Improved
usability
Hardened
Reduced
Cost
Across the
compute
continuum

| |
Industry Overview

| |
POLLING QUESTIONS – TO USE READYTALK’S POLLING FEATURE
ARE YOU CONFIDENT THAT YOUR SIEM IS PROVIDING YOU WITH ALL THE FLEXIBILITY AND FUNCTIONALITY
YOR CYBERSECURITY ANALYTIS TEAM NEEDS TO DEFEND YOUR ENTERPRISE?
-YES IT IS SUFFICIENT FOR OUR NEEDS
-I DON’T KNOW ENOUGH ABOUT OUR NEEDS TO MAKE THAT DECISION
NO, WE DON’T KNOW IT ISN”T THE LONG TERM PLATFORM FOR OUR ORGANIZATION
Is your organization considering any of the following projects/tools/solutions to improve visibility and
security analytics across your enterprise:
- User/Entity Behaviors Analytics
- Network Behavior Analytics
- Big Data Security Analytics Platform

The environment has changed…
Hackers are more
sophisticated
Attacks are more
frequent
The world is hyper
connected

…but systems have not.
The environment has changed…
Only detect known
threats
Old world data
security is hard to
manage
Explosion in number
of touch points

Legacy Cyber Solutions
(TBs)
Aggregated
Events
Raw
System Logs
Network
Flows/ DNS
Full
Packet
Capture
Video,
Text, Images
User
Data
Data Types
(MBs>PBs)
Search
Correlations
SQL
Machine Learning
Advanced Statistics
1
10
20
40
Time
(Months)
3
1 Market Trends: User and Entity Behavior Analytics (UEBA) Expand Their Market Reach – Gartner April 2016
18
Traditional solutions struggle to keep up…

Discovering unknown threats with
advanced analytics (machine learning)
is impossible on traditional systems
Status quo can’t keep pace with the threats we face
Storing, processing, and analyzing 100s
of billions of events is not economically
or technical feasible today
Integrating cross applications data for context
and new analytics is not trivial
Network
Endpoint
User
Analytics
Challenge
Scale
Challenge
Silo Challenge
Time
Events
TrillionsBillionsMillions

NetworkUser Endpoint LogsApplication File
Context
2
Siloed data and applications limit visibility, weaken analytics and
extend the time to detect incidents.

Legacy Cyber
Solutions
(TBs)
Aggregated
Events
Raw
System
Logs
Networ
k
Flows/
DNS
Full
Packet
Capture
Video,
Text,
Images
User
Data
Data Types
(MBs>PBs)
Search
Correlations
SQL
Machine Learning
Advanced Statistics
1
10
20
40
Time
(Months)
3
Cloudera’s Hadoop Based Cybersecurity
Solutions
(PB)
• Gartner named Cloudera
Non-Security-Specific
Analytics Vendors to Watch1
• 60% of UEBA Vendors to
Watch use CDH1
• 25% of Network Traffic
Analysis Vendors to Watch
use CDH1
Powering the next generation of cybersecurity analytics
1 Market Trends: User and Entity Behavior
Analytics (UEBA) Expand Their Market Reach –
Gartner April 2016

Cyber threats change.
Keep one thing
constant, Cloudera.
Custom Open
Data
Model
Open
Data
Model
Enterprise
Data Hub
Packaged

Niara Behavioral Analytics
Karthik Krishnan
VP Product Line Management

24© 2016 Niara Inc. All Rights reserved.Proprietary and Confidential
THE PROBLEM
PREVENTION & DETECTION
NOT ENOUGH
INCREASINGLY PORUS
MONITORING SYSTEMS
FALLING SHORT
CANNOT DETECT UNKNOWN THREATS
AND UNABLE TO SCALE
+

THREAT INTELLIGENCE VS. SECURITY ANALYTICS
• Crowdsourced Indicators of
Compromise (IOC)
• Signatures, Rules, Blacklists
• Curated feeds to more rapidly
respond to latest threats
• Machine learning driven
• For advanced, unknown threats that
don’t have a signature, rule or
blacklist
• Examples are compromised
credentials, negligent insiders

AUTOMATED DETECTION OF
THREATS INSIDE THE ORGANIZATION
Compromised
Users & Hosts
Negligent
Employees
Malicious
Insiders
ATTACKS AND
RISKY BEHAVIORS
on the inside

BASICS OF BEHAVIORAL ANALYTICS
ABNORMAL INTERNAL
RESOURCE ACCESS
Behavioral
Analytics
UNSUPERVISED
+
SEMI-SUPERVISED
HISTORICAL
+
PEER GROUP
MACHINE LEARNING BASELINES

FINDING THE MALICIOUS IN THE ANOMALOUS
Behavioral
Analytics
SUSPICIOUS
FILE DOWNLOAD
ANOMALOUS
DNS REQUEST
UNUSUAL PRIVILEGE
ESCALATION
ABNORMAL INTERNAL
RESOURCE ACCESS
IRREGULAR EXTERNAL
DATA UPLOAD
SUPERVISED
MACHINE LEARNING
DLP
Sandbox
Firewalls
STIX
Rules
Etc.
THIRD PARTY ALERTS

ENTITY360™ SECURITY DOSSIER

BEHAVIORAL ANALYTICS ACROSS MULTIPLE
DIMENSIONS

MODEL CONFIDENCE AND BUSINESS IMPACT
Business
Impact
Model
Confidence

FORCE MULTIPLIER FOR SECURITY ANALYSTS
Consolidated Data Access
Rapid Decision-Making and Action
“Have I seen this before?”
BREAKTHROUGH ROI
for Incident Investigation
and Threat Hunting

ACCELERATED INVESTIGATION AND RESPONSE
Behavioral
Analytics

UBA INCIDENT RESPONSE ROI

SOLUTION AT A GLANCE
Console / Workflow
SIEM/LOGGING
PACKET
BROKER
NETWORK TRAFFIC
PACKETS
FLOWS
IDENTITY
INFASTRUCTURE
Logs
SaaS
laaS
ALERTS
AD, DHCP
DNS, Firewall, Proxy,
VPN, Email, DLP
Endpoint, Network, STIX
ANALYZER
ENTITY360
ANALYTICS FORENSICS
DATA
FUSION BIG DATA
Spark/Hadoop
Box, Office360
AWS, Azure

• Founded 2013
• Focused on solving two key problems
• Detecting attacks that have co-opted legitimate credentials
• Reducing the time and effort required to understand and respond to attacks
• Enabling technologies
• Big Data: Spark/Hadoop
• Artificial Intelligence: Machine Learning
NIARA OVERVIEW

| |
Interested in learning more?

Invitation
• Join us: Breach Security Benchmark
• Analyze your breach security
– Maturity level, priorities, capabilities
– Compared to healthcare industry
– Possible over / under prioritization
– Gaps, areas lagging the industry, and
relative vulnerabilities
• A tool you can use to help rally support to
address gaps
• 1 hour, confidential, complementary
• Conducted by Intel or industry partner
38
Find our more and see an
example report at
Contact BreachSecurity@Intel.com

| |
Contact our experts
Schedule a discovery session with our
experts
Discuss how Niara, Cloudera and Intel can
work with you
Rocky DeStefano
rocky@cloudera.com
Karthik Krishnan
karthik@niara.com
David Houlding
david.houlding@intel.com

| |
Thank You

Legal Disclaimers
Intel® vPro™ Technology: Intel® vPro™ Technology requires setup and activation by a knowledgeable IT administrator. Availability of features and results will depend upon the setup
and configuration of your hardware, software and IT environment. Learn more at: http://www.intel.com/technology/vpro.
Intel® Active Management Technology (Intel® AMT): Intel® AMT should be used by a knowledgeable IT administrator and requires enabled systems, software, activation, and
connection to a corporate network. Intel AMT functionality on mobile systems may be limited in some situations. Your results will depend on your specific implementation. Learn more by
visiting Intel® Active Management Technology.
Intel® Data Protection Technology: No computer system can be absolutely secure. Requires an enabled Intel® processor, system and software designed to use the technology. Check
with your manufacturer or retailer. Intel® Data Protection Technology with AES-NI and Secure Key
Intel® Identity Protection Technology (Intel® IPT): No computer system can be absolutely secure. Intel® IPT requires an enabled system, including a processor, chipset, firmware,
software, and (in some cases) integrated graphics, and participating website or service. Intel does not assume any liability for lost or stolen data or systems or any other damages.
Check with your manufacturer or retailer for more information. Learn more at http://ipt.intel.com/.
SSD Pro: No computer system can provide absolute security under all conditions. Built-in security features available on select Intel® Solid State Drives may require additional software,
hardware, services and/or an Internet connection. Results may vary depending upon configuration. Consult your system manufacturer for more details.
©2014, Intel Corporation. All rights reserved. Intel and the Intel logo are trademarks
of Intel Corporation in the US and/or other countries.
OK for Non-NDA Disclosure
* Other names and brands may be claimed as the property of others.
All information provided here is subject to change without notice. Contact your Intel representative to obtain the latest Intel product specifications and roadmaps.
Software and workloads used in performance tests may have been optimized for performance only on Intel microprocessors. Performance tests, such as SYSmark and MobileMark, are
measured using specific computer systems, components, software, operations and functions. Any change to any of those factors may cause the results to vary. You should consult other
information and performance tests to assist you in fully evaluating your contemplated purchases, including the performance of that product when combined with other products. For more
complete information visit http://www.intel.com/performance.
41

Protecting health and life science organizations from breaches and ransomware

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Protecting health and life science organizations from breaches and ransomware

Similar to Protecting health and life science organizations from breaches and ransomware (20)

More from Cloudera, Inc.

More from Cloudera, Inc. (20)

Recently uploaded

Recently uploaded (20)

Protecting health and life science organizations from breaches and ransomware