Vancouver security road show master deck final

Editor's Notes

• #3: Key Message – Our Security Portfolio is focused on the question of how to secure core infrastructure. We deliver Security by focusing on next generation technologies & adaptive defensive techniques. Our experience in this space has shown us that threats are evolving very rapidly, and our approach emphasizes using leading next gen technologies rather than large, monolithic architectures, allowing you to react quickly to changes as they evolve. We back that up with industry leading expertise – we are the only authorized training centre in Canada for next-gen security technologies like Palo Alto Networks, F5 and Infoblox, leaders in their respective spaces. And we maintain technical & sales certifications with leading security companies including McAfee, Cisco.Key Partners & Technologies - Palo Alto, Fortinet, FireEye, McAfee, Cisco, F5, InfobloxProtection & DefenceThe first line of defence is to stop unwanted intrusions & attacks so that they never penetrate your network. Scalar can design and deliver solutions to protect your network and applications, control your DNS & IP address properties and control user activity while ensuring speed and performance are maintained. Incident & Event ManagementWhile protection is critical, it’s equally as important to deliver a rapid, effective & coordinated response to any intrusion or attack. That requires processes, discipline and tools, including a 24/7 Security Operations Centre with the staff & training to operate it. That’s how Scalar helps customers secure hundreds of endpoints, devices and networks. Threat Assessment & Penetration TestingImproving your security posture means you need to understand where your vulnerabilities are. A vulnerability assessment can not only identify vulnerabilities in a system, but can help prioritize & rank the order in which they should be fixed, and educate internal stakeholders of the potential risks that exist. And while online tools exist, interpreting the results and developing a plan can be overwhelming for IT departments that lack the staff with the necessary skills. Scalar can conduct the assessments, and our analysts can work with you to develop a plan to close potential threats.
• #4: Key Message – Our Security Portfolio is focused on the question of how to secure core infrastructure. We deliver Security by focusing on next generation technologies & adaptive defensive techniques. Our experience in this space has shown us that threats are evolving very rapidly, and our approach emphasizes using leading next gen technologies rather than large, monolithic architectures, allowing you to react quickly to changes as they evolve. We back that up with industry leading expertise – we are the only authorized training centre in Canada for next-gen security technologies like Palo Alto Networks, F5 and Infoblox, leaders in their respective spaces. And we maintain technical & sales certifications with leading security companies including McAfee, Cisco.Key Partners & Technologies - Palo Alto, Fortinet, FireEye, McAfee, Cisco, F5, InfobloxProtection & DefenceThe first line of defence is to stop unwanted intrusions & attacks so that they never penetrate your network. Scalar can design and deliver solutions to protect your network and applications, control your DNS & IP address properties and control user activity while ensuring speed and performance are maintained. Incident & Event ManagementWhile protection is critical, it’s equally as important to deliver a rapid, effective & coordinated response to any intrusion or attack. That requires processes, discipline and tools, including a 24/7 Security Operations Centre with the staff & training to operate it. That’s how Scalar helps customers secure hundreds of endpoints, devices and networks. Threat Assessment & Penetration TestingImproving your security posture means you need to understand where your vulnerabilities are. A vulnerability assessment can not only identify vulnerabilities in a system, but can help prioritize & rank the order in which they should be fixed, and educate internal stakeholders of the potential risks that exist. And while online tools exist, interpreting the results and developing a plan can be overwhelming for IT departments that lack the staff with the necessary skills. Scalar can conduct the assessments, and our analysts can work with you to develop a plan to close potential threats.
• #5: Growth Recognized on the PROFIT list of the fastest-growing companies in Canada for the last four years (since we became eligible in year 5 of our business). In 2013, we were 94 on the overall list, but 15 within the IT industry, and one of the highest-revenue companies overall.Canadian company with nationwide presenceNumber 15 on the CDN List of Top 100 Solution ProvidersAlso named #46 on Branham300 of Canada’s leading ICT companiesWe have a deep technical bench, we are not a call centre shipping product, we position ourselves as an extension of your business, and have the team in place to back this upThough Scalar is in its 10th fiscal year, our founders have been doing this since 1990 when they were running Enterprise Technology Group (ETG). Since then that team has delivered over $1BN in mission-critical infrastructure.
• #6: Growth Recognized on the PROFIT list of the fastest-growing companies in Canada for the last four years (since we became eligible in year 5 of our business). In 2013, we were 94 on the overall list, but 15 within the IT industry, and one of the highest-revenue companies overall.Canadian company with nationwide presenceNumber 15 on the CDN List of Top 100 Solution ProvidersAlso named #46 on Branham300 of Canada’s leading ICT companiesWe have a deep technical bench, we are not a call centre shipping product, we position ourselves as an extension of your business, and have the team in place to back this upThough Scalar is in its 10th fiscal year, our founders have been doing this since 1990 when they were running Enterprise Technology Group (ETG). Since then that team has delivered over $1BN in mission-critical infrastructure.
• #7: Core infrastructure is our background, our experience, and the primary focus of what we do – it underpins our business.As infrastructure has changed with the industry to be spread across public, private, hybrid etc, our customer needs have changed, and therefore so does our portfolio and focus. Today, we focus on building core infrastructure and then assisting our clients in securing it, ensuring it is running well (performance), and managing it (control).Though core infrastructure is the delivery vehicle for all applications, we do not deal at the application layer – We deal with security, performance, and control only as they relate to core infrastructure. This focus allows us to be the very best at what we do.We answer the questions:Core Infrastructure – How to Build It?Security – How to secure it?Performance – How is it running?Control – How to manage it?
• #8: Feel free to remove these section cover-slides
• #10: Also: Dedicated PMO, finance, inside sales and operations teams. Every team in our organization is the best at what they do.It’s difficult to prove experience on a powerpoint slide. Take a meeting with us and we’ll show you how our technical team is world-class.
• #11: Unique infrastructure solutions designed to meet your needsA great example is StudioCloud. When our media customers came to us with a problem, we developed an entirely new way for them to do business. We didn’t attempt to sell them more compute, or optimize their individual environments – we helped them form a coalition and a community cloud that allows them to pay for servers on an as-needed basis, and sub-lease to other companies in our cloud when they have excess capacityWhether it’s a product-based solution, a professional service, or a managed service, we deliver the solution.Testing Centre & Proving GroundsWe train our engineers to be constantly evaluating and testing emerging vendors in our in-house testing centre. We offer fresh, cutting-edge technologies to our customers, while at the same time ensuring we have vetted, tested, and trained in those technologies. We offer leading-edge technologies that we KNOW are up to the task of Enterprise environments.Vendor BreadthWe offer both current and future market leaders in our portfolio.
• #12: Execution is difficult to demonstrate on a slide, so instead we’ve decided to show you what some our customers have said about us.Our tagline says it all – We Deliver. This is not “marketing speak” but the foundation of our business. Our commitment is first and foremost to our customers and we strive to become a trusted advisor and an extension of your business. This does not happen overnight, but rather through proving ourselves again and again. We are dedicated to finding the right solution for your business needs and delivering it to you efficiently and effectively.
• #13: You may wish to switch some of these out depending on the specific messaging of your presentation. See appendix slides for more logos that you can copy and paste in. Please try not to have more than 12-15 logos on the slide overall.
• #16: The most significant risk of social media and video is the enticement factor. Awwww, so cute I must click – then bam….looky what I got. This is how the zerogen access bot is delivered – it is one of the most commonly found bot these days…Real cyberattacks are considerably more sophisticated than the attacks that one would expect to see even a few years ago. Most of these attacks will leverage multiple steps, in which each step builds on the previous toward a strategic goal. Multiple techniques are coordinated to work together, and the attackers attempt to hide their traffic and infrastructure whenever possible. This example walks through the very common steps of a modern data breach.Step 1 – Many attacks today begin by using a compromised website to deliver an exploit and malware to an end-user. This process is called a drive-by-download and it often begins with something called an exploit kit. For example, Blackhole is a very well-known exploit kit. An attacker can craft a website that uses the exploit kit or simply find a vulnerable website where the attacker can add his exploit kit code. Either way, once the exploit kit code is running on the target website, the exploit kit will automatically identify vulnerable visitors to the site and exploit the end-user machine.Step 2 – Once the exploit has been delivered to the target, now the user is now compromised, and the attacker can deliver malware to the compromised user. The malware is typically not delivered from the same site hosting the exploit kit, as this would very quickly make it obvious that the site was infected. Instead the attacker will redirect traffic to new or unknown domain to deliver the malware. The attacker can constantly cycle through these domains to keep his operation a secret.Step 3 – Once malware is delivered to the target, it is often the job of the first stage malware to establish persistence and communication on the infected host. In many cases this is done via a root-kit and downloader. Zero Access is very common rootkit that meets this requirement, but there are many others.Step 4- Once the rootkit is installed, it now needs to set up a command-and-control channel with the remote attacker. This link is one of the most important in the attack lifecycle because it provides the attacker with remote control over his attack, and a control point inside the target network. This traffic tends to be highly evasive because the attacker is in control of both ends of the connection (both the malware sending the traffic and server that it is communicating with). This gives the attacker a great deal of freedom in terms of ports, protocols, encryption and tunneling.Step 5 – Once the attacker is inside the network, and communicate back out, he can now download a second wave of malware that is more geared to the actual goal of the attack, such as stealing information. These payloads can be customized to a particular attack and often give a more unique view into the attacker and the ultimate goal of an attack. Step 6 – Often it is the goal of the secondary payload to dig deeper into the network to access protected data. To do this the attacker will attempt to spread to other nodes in the network, and to attempt to escalate his privilege in the network. For example, the attacker may have initially compromised a low level employee with limited rights on the network. The attack may try to use that initial compromise in order to steal credentials for a network administrator in the network, which in turn would provide free reign over the network.Step 7 – As part of digging deeper into the network, attackers will often leverage a variety of hacking tools both to enumerate the internal environment, find weaknesses and steal data. Furthermore, the attackers will use a variety of techniques to quietly communicate from inside the network. This can include custom protocols that have been designed by the attackers or traffic and covert communications that are tunneled within allowed traffic. Step 8 – Of course the ultimate goal of most attacks is to steal data. What this data is will of course vary depending on the target, but can include everything from credit card numbers to personally identifiable information, to trade secrets and intellectual property. This often requires using applications that are effective at transferring large volumes of data such as FTP, peer-to-peer applications or other web-based file transfer applications.
• #25: FTP was the most interesting application observed in the review. Most samples appeared to be targeted, were never covered by AV, were rarely seen in more than one location and were almost always evasive in terms of port usage. 97% of the FTP sessions never touched port 20 or 21. This is a stark reminder that even some of the old network standards can be a real source of threats.
• #32: Commonly observed network traffic behaviors observed in malware generated traffic. Unknown or custom traffic was the most common identifier in malware traffic. Unknowns can be blocked proactively or investigated by IT to determine if they are malware or not.Unknown or newly registered domains were also very common. Customers may not want to block all unknown domains, but it is very easy to create a rule to never accept files or executables from these unknown sites. The next 3 slides show how to do this.
• #37: Now that we have seen some information about the malware that is getting through our defenses, lets shift gears and talk about what we can do about it. One of the most interesting aspects of the study, was that we saw that a large percentage of seemingly unique malware, was actually not unique after all. Our stream-based malware engine looks into the header and body of malware to find unique identifiers for blocking. These signatures were able to detect that 40% of samples (with unique hash values) were actually just repackaged versions of malware that we were seeing earlier in the day. This directly shows the value of the WildFire subscription because 40% of the malware that is leaking into the network can be blocked proactively if signatures are delivered on time.
• #38: Attackers changed – Why it matters? Because nation states and organized crime know what to do with stolen property. Previously a hacker may have been able to break into a network. But what will they really do with RSA source code?
• #44: Want to touch on:You’ve heard about ISPThe purpose of this preso is provide more info on the security servicesBefore we do that let’s talk about some technology trendsMobility and elasticity of data centers (consolidation, webification, private & public clouds… data centers have changed)Before ip we had sna, ipxEach app had it’s own portNow consolidating all these apps down to HTTPSComplexity resides over HTTPImpacting over all infrastructure
• #46: {NOTE TO SPEAKER: The key points to get across on this slide really are around the fact -- and this can be conveyed and leveraged in multiple different ways. What I like to articulate here is really that if you look at the attack types, you know, major attack types that exist here are application type attacks and web attacks. In addition to that, you can see here that the key thing is every single one of these customers in themselves had a firewall, and it was most likely a next generation firewall. And the reality of the situation is once again due to the fact that they leverage a piece of technology that was not designed to protect their data center, the resulting effect was that they weren't protected and they were exploited. And it's important that the individual conveying the slide, if you're talking to a partner, that you can articulate that you do not want your customers to be one of the next large bubbles or bubbles that exist on this eye chart. Or if you happen to be a customer the last thing that you want is the company that you're working for or protecting to be on this eye chart.}
• #47: {NOTE TO SPEAKER: The key points to get across on this slide really are around the fact -- and this can be conveyed and leveraged in multiple different ways. What I like to articulate here is really that if you look at the attack types, you know, major attack types that exist here are application type attacks and web attacks. In addition to that, you can see here that the key thing is every single one of these customers in themselves had a firewall, and it was most likely a next generation firewall. And the reality of the situation is once again due to the fact that they leverage a piece of technology that was not designed to protect their data center, the resulting effect was that they weren't protected and they were exploited. And it's important that the individual conveying the slide, if you're talking to a partner, that you can articulate that you do not want your customers to be one of the next large bubbles or bubbles that exist on this eye chart. Or if you happen to be a customer the last thing that you want is the company that you're working for or protecting to be on this eye chart.}
• #49: Loss of business/customer baseLoss of intellectual propertyRegulatory Fines/Legal costsCost of corrective actionCost of volumetric flood serviceChanging methods of doing business – drives new processes. Partners loss of trust in working with your company. Scrubbing service.Reputation Management
• #53: Leveraging its expertise in application delivery and its deep fluency with applications, F5 introduces the Application Delivery Firewall, a new solution that integrates multiple networking and security components onto a single platform. The F5 Application Delivery Firewall runs across the entire product platform line, from virtual editions to the BIG-IP hardware line to the VIPRION. The F5 Application Delivery Firewall includes an integrated native network firewall, which is ICSA lab certified, traffic management, industry leading application security, access control, DDoS mitigation, SSL inspection, and DNS security. It's also important to notice that the F5 ADF, besides the ICSA firewall certification, also is certified for IPsec, SSL VPN, and web application firewall. On top of that the F5 Application Delivery Firewall has EAL2+ common criteria certification and EAL4+ is currently in progress.
• #55: When you’re delivering an application, you also have to worry about security. Again you have a few options – you can try to modify the application, you can put in point solutions, or you can use your ADC as a strategic point of control to secure both your applications and your data. BIG-IP LTM has a number of features that provide security at the application level.Resource cloaking and content security – Prevent error codes and sensitive content from being presented to hackersCustomized application attack filtering – search for and apply rules to block known application level attacksPacket filtering – L4 based filtering rules to protect at the network levelNetwork attack prevention – protect against DoS, SYN floods, and other network attacks while delivering uninterrupted service for legitimate connections.Message Security Module (add-on module)Protocol Security Module (add-on module)Application Security Manager (add-on module)
• #57: One of the key use cases of the application security solution is to provide defense and mitigation against HTTP and HTTP-S based DOS attacks. And the way that we achieve this is a couple of ways.  And here what we have is a screenshot of the configuration. At the base level we're able to detect a DOS condition based on certain conditions. In this case it's what we're highlighting here is configurable parameters for latency. If the latency falls outside of the bounds, then we raise -- then it looks like a potential denial of service condition. Added to that we're able to identify potential attackers by some additional -- by layering on top of that some additional criteria. In this case what we're seeing here is the TPS metrics. And if that falls out of specified bounds, then we add to the -- then it looks additionally suspicious. And then finally what we do is we drop only the attackers, and we're able to distinguish based on a couple of parameters, namely some source IP based, some URL based parameters. And the idea is that what we want to do is block the malicious attackers but at the same time allow through valid users, because we don't -- the denial of service mitigation is more than just blocking all connections, right? We want to make sure that the availability of the application is maintained.
• #59: Unable to secure disperse web appsNo virtual WAF option for private cloud apps Replication of production environment complicated and cost-prohibitiveNeed to block app requests from countries or regions due to compliance restrictionsLimiting app. access based on location is a good practice to quickly reduce the attack sourcesScanner scans applications to identify vulnerabilities and directly configures BIG-IP ASM policies to implement a virtual patch that blocks web app attacksBIG-IP ASM is now importing vulnerabilities – not patches – (in v11), it effectively becomes a Vulnerability Management Tool along with being WAF.  Obviously, the net effect is enabling very rapid response, particularly in the instance where you're waiting for the third-party vendor to patch the vulnerability.
• #60: {NOTE TO SPEAKER: At this point in time in the presentation we should have already built the premise that we have an intelligent service platform, that we are discussing the security services portion of that platform, and that a huge advantage of our security offering is our full proxy architecture, and that since we have a custom built hardware we are able to achieve speeds and feeds that are far superior to anyone else. The other thing that we really need to be able to convey in this slide is that our technology has been designed for customers of the data center, and our requirements have always been driven from service provider, you know, in very, very large customers with very, very significant demands.  I don't normally mention Facebook specifically named, but I talk about the fact that we have customers that have a billion unique users that are actually traversing our particular technology. And these advantages have really enabled us to be able to build a security technology that is far superior to what our competition is. And so I like to convey that I've worked with customers that have load balanced firewalls, that they load balanced logs coming from firewalls, and even just recently I talked to a customer that actually was load balancing Juniper SSL VPNs. And I asked him how many users they had, and they had 20,000 users. And what was interesting is our largest box can do 5x of what that box can do, and they were having to load balance I think six or seven other devices. So we really need to be able to tie specific use cases in this slide, we really need to be able to tie this back to our custom-built technology, and then we really need to be able to also ensure that they understand other elements such as the fact that DDoS requires connections per second, it requires the ability to ramp connections, it requires the ability to sustain connections, but in addition to that, beyond just malicious DDoS, just traditional increase in traffic from good purposes also require significant increase in connections per second. And they should have, all of our customers should have the capacity to be able to withstand, whether it's malicious or non-malicious. So it's very critical that we're able to not just give these numbers as a bunch of blah but that we're actually able to articulate and correlate and tie these back to why it's so beneficial that each of these stats will provide them significant value. You know, one more element here is speaking on the access side of it is that as more users, more things become mobile, as more applications are moved out to the cloud, the demand on remote access devices is significantly increasing.  So we've spent a lot of time talking about our data center firewall or the ADF, and we've spent a lot of time talking about the needs and speeds and feeds in other areas, but it's also very critical that the demand on our customers around remote access also has just as much of a need for these performance requirements.}
• #61: Here we have a view of the Application Delivery Firewall solution as it maps to the constituent software modules in the BIG-IP family. It's important to note that ADF is an umbrella solution with various software modules that can be licensed, depending upon the exact requirements and the deployment scenario for the customer. And what this means is that there's an extensibility in investment protection in the BIG-IP system, meaning that at its core the Application Delivery Firewall, which consists of the Advanced Firewall Manager as its base, is extendable, and customers can add on additional modules as they need, depending on what their network demands. So as I mentioned, AFM, the BIG-IP AFM is the base, the foundation of the ADF solution. And AFM is the integrated, the native stateful full proxy firewall upon which the rest of the security modules are oriented. So AFM has the integrated UIs, so the configuration of security policy is oriented around applications. It has flexible logging and reporting, which is also detailed, which enables security teams to do analysis on what's going on with their security posture in the network. It natively supports, of course, layer four up through layer seven, so native TCP, SSL and HTTP full proxies. And the SSL, of course, includes the SSL visibility. And it also includes network and session DDoS mitigation. So aside from AFM, there's BIG-IP LTM, and this is, of course, the traffic management or the application delivery controller functionality that F5 excels at. So this is the industry's number one, the leading application delivery controller, which really brings with it the application fluency and the per application or the app specific health monitoring. Aside from that, the rest of the modules that are available are BIG-IP ASM. This is our web application firewall product, which is a no-brainer for PCI compliance needs. PCI compliance requires at a minimum web application firewall or the alternative to that would be very expensive annual security audits. ASM also has virtual patching for newfound vulnerabilities. It has with it also HTTP DDoS mitigation, and IP detection. IP is intellectual property. So this is the ability to detect bots that would basically do screen scraping.  So imagine you have a website -- actually strike that, because there's going to be another slide that talks about IP protection in specific. So let's move to BIG-IP Access Policy Manager. So this is APM, and it has not only identity access control but also includes the SSL VPN component. But this really is what does the unified access management for applications. And additionally we have GTM and DNS SEC. GTM is the Global Traffic Manager, which is essentially an extremely scalable DNS solution, but at the same time can also offload DNS queries and also even assign DNS responses. Beyond this, we also have IP intelligence and geolocation. These are licensable modules or -- yeah, these are licensable add-ons, not licensable modules but licensable add-ons which provide context-aware security. So IP intelligence, for instance, provides with it reputation information, so based on the source IP address. So source IP address comes in and -- well, anyways, again strike this, because there's an additional slide covering this. But also geolocation, and geolocation is the ability to tie an IP address to a specific region in the world. So with both IP intelligence and geolocation what we're able to do is make more intelligent decisions. This is the context-aware intelligence that we speak about. Of course, supporting all of this we have iRules, which is the extensibility piece of the BIG-IP family, and iRules is the ability to have -- it's a scripting language, which allows the BIG-IP system to have customizable actions in the data plane depending on specific something or other. And that something or other would be characteristics within the traffic itself that's transiting the system. 
• #68: Splunk now has more than 850 employees worldwide, with headquarters in San Francisco and 14 offices around the world.Since first shipping its software in 2006, Splunk now has over 6,000 customers in 90+ countries. These organizations are using Splunk software to improve service levels, reduce operations costs, mitigate security risks, enable compliance, enhance DevOps collaboration and create new product and service offerings. Please always refer to latest company data found here: http://www.splunk.com/company.
• #69: At Splunk, our mission is to make machine data accessible, usable and valuable to everyone. Andthis overarching mission is what drives our company and product priorities.
• #70: Data is growing and embodies new characteristics not found in traditional structured data: Volume, Velocity, Variety, Variability/Veracity.Machine data is one of the fastest, growing, most complex and most valuable segments of big data.All the webservers, applications, network devices – all of the technology infrastructure running an enterprise or organization – generates massive streams of data, in an array of unpredictable formats that are difficult to process and analyze by traditional methods or in a timely manner. Why is this “machine data” valuable? Because it contains a trace - a categorical record - of user behavior, cyber-security risks, application behavior, service levels, fraudulent activity and customer experience.
• #72: Our rapid ascent reflects the customer traction we have and value we deliver to customers – with over 2800 security customers and 50% year-over-year growth, we are the fastest growing SIEM vendor in the market. In 2 short years we raced up to the top quadrant in the MQ.
• #73: SC magazine award was determined by the readers of SC Mag who are IT Security professionals. We beat out:HP for ArcSight ExpressIBM Software Group for QRadar SIEMLogRhythm for LogRhythmNetIQ for NetIQ Sentinel 7SolarWinds for SolarWinds Log & Event Manager (LEM)
• #74: Over 2800 security/compliance customers worldwide. Customers cover all sizes and verticals, and are all over the world. While not listed here, hundreds of SMBs and individuals also use for security/compliance.Over 2800 customers use Splunk for security and/or compliance use casesApprox. 400 use the Splunk App for Enterprise SecurityFirst introduced in 2009 with v1.0Customers using Splunk to build their own SIEM as early as 2007Leader in the Gartner MQ in 2013Splunk used for adjacent use cases such as fraud, compliance and insider threatsWidely used across many verticals for securityFlexibility, Scalability, Speed (time-to-answer), search and analytics are why customers use Splunk for security
• #75: 1 solution for Splunk for Security, but 3 offerings. At bottom is Splunk Enterprise, our core product. Every Splunk deployment includes this as this is where the core indexing and searching resides. Many customers build their own searches/reports/dashboards on top of it. On top of it, optional Apps can be installed. Apps are basically a collection of reports, dashboards, and searches purpose-built for a specific use case or product. Can be built by Splunk, customer, partners and all but a few are free on Splunkbase. Apps are great for customers who want out-of-the-box content and do want to have to build it themselves, and want to extend point solutions. One key App is the Splunk-built Enterprise Security app with the arrow pointing at it. It is basically an out-of-the-box SIEM with reports, dashboards, correlation rules, and workflow for security use cases. (It does have a cost though) Besides this app there are over 80 security-centric free Apps on Splunkbase. These are offering 3.The majority of Splunk security customers do Splunk Enterprise and the free apps. Also customers do leverage the API and SDKs that come with Splunk to further extend the platform.
• #77: Key part of IT security is protecting confidential data. Which means detecting advanced threats, like cybercriminals or malicious insiders, before they can steal your data. To detect or investigatethem, you need non-security and security data because advanced threats avoid detection from signature-based security products; the fingerprints of an advanced threat often are in the “non-security” data. Most traditional SIEMs just focus on gathering signature-based threats which do *not* have the fingerprints of advanced threats.Also the above scenario is worse if there is no SIEM. Instead point UIs and grep are used and aggregating data is very manual and time consuming.
• #78: To make sound security decisions 4 data types requiredTraditional structured and unstructured log dataBinary data -- flowdata for machine to machine communications and packet capture for analysis of packet payloads looking for malicious code in PDFs, TIFFs or PNGs, or email for example Context data is the data locked in business systems that are clues to employee behaviors – examples is Joe on vacation, has he not taken a vacation in the last 24 months, who’s being laid off, etc.Threat intelligence data that can tell us in near real-time about new IPs and domains that may be maliciousThe sheer volume, velocity, variety and variability of the data make this a big data problem
• #79: Use case 1. Alert from a point product UI or traditional SIEM. Pin board image on right indicates “cold case/CSI” sort of investigation that Splunk can enable. (FYI - papers on the pin board image do not tell a “real” investigation story so do not try to read all the images on the pin board). From a forensics perspective, things like endpoint OS logs or packet captures can be put into Splunk at the time of the investigation to get deeper into the details.With exiting SIEMs they struggle with incident investigations because they cannot:Retain all the original unmodified data (because the normalize/reduce it)Often it is hard to pivot among the data b/c it is in different data stores (logger/SIEM/Hadoop/etc) with no common UIQuickly return back search results (because their DB causes scale/speed issues)Limited flexibility/ability to do external lookups
• #80: Use case 3. It is about about taking thousands of security events that are low severity in isolation and connecting the dots in an automated, policy-driven manner to see when a combination of seemingly low severity events, when correlated, is actually a high-severity incident that needs immediate attention.There are hundreds of possible cross-product correlations. One is above and tells the story of a data loss event being detected by signature-based security productsFor a specific internal IP address running Windows, someone logs into it using a default administrative user name “Administrator” which is not good. All users should have a unique user name (not root or Administrator) so you know exactly who is doing what in the IT environment. The OS logs see this log in.Endpoint-based anti-malware sees known, bad malware running on that machine. Malware means “malicious software” and is a red flag because it may lead to data being stolen by a hackerA data loss prevention tool (in this case the Snort Intrusion Detection Prevention product) sees unencrypted credit card numbers leaving the organization from the above machine. This data loss of credit cards is a major red flag.Why these 3 events are bad: These 3 events happening on the same machine in a short time period indicates a hacker inappropriately logged into the machine, probably using stolen credentials, then put malware on the machine, perhaps a backdoor to remotely connect back to the machine later, then exfiltrated stolen credit cards from the machine. The credit cards may have then been used for illegal purposes which ultimately may have resulted in the costs of re-issuing credit cards, bad publicity, unhappy customers taking their business elsewhere, customer lawsuits, fines for PCI non-compliance, etc.Splunk can correlate on all these 3 events happening on the same machine and within a short time period. It has connected the dots to find the proverbial needle in the haystack. Splunk can detect and/or alert on these sorts of correlations in real-time or on a scheduled bases.Two other sample correlations:Firewall on an internal PC indicates the PC is being port scanned from an internal IP addressNetwork-based firewall indicates it is being port scanned from the same internal IP addressImportant settings have been changed on the suspicious internal machineWhy: The machine associated with the IP address may have been compromised by a threat which is doing internal reconnaissanceVulnerability scanner shows that an internal server has an unpatched OSIntrusion Detection System sees an external attack on that specific server that exploits the vulnerability in the OS Why: The server is likely to be successfully compromised
• #81: Use case 4. Like prior slide so see notes at the top. But in this case the events being correlated on all are from “non-security” data sources. This is because the threats are “unknown” to traditional security products because no signature exists for them. Each of these events in isolation would raise no alarms. Only when combined can see you see that they are risky because they represent outliers/anomolies that could be advanced threats like a sophisticated cybercriminal or a nation-state.There are hundreds of possible cross-product correlations. One is above and tells the story of a spearphising attack done in order to obtain and steal confidential data. More sample correlations are on the next slide. In this scenario above Splunk is keeping track of all the external email domains that are sending emails into the company, all external web sites being visited by internal employees, and all the services and executables running on internal machines. It can automatically count up things like # of emails received by each external domain, # of times employees visit external web domains, etc, to see the rarely seen items that are outliers. In the above scenario:Splunk sees an email reach an internal employee from an external email domain that has never/rarely been seen beforeThat same employee then visits a web site that is never/rarely visited by internal employeesA service starts up on the employees machine that is never/rarely seen in the organizationWhy these 3 events are bad: These 3 events happening on the same machine in a short time period indicates a hacker has performed a spearphising attack. They sent a realistic looking email to an internal employee that compelled the employee to click on a link or open an executable. This resulted in the web site dropping malware on the machine.Splunk can correlate on all these 3 events happening on the same machine and within a short time period. It has connected the dots to find the proverbial needle in the haystack. Splunk can detect and/or alert on these sorts of correlations in real-time or on a scheduled bases.
• #82: Interac, a leader in debit & electronic payment services out of Canada. On Splunk.com we have an ROI story for them and they have presented at Splunk events several times.Before Splunk, they used point UIs and grep to do security investigations and run daily security reports. Very time consuming and inefficient. They would have many different personnel involved in security-related data collection, analysis and correlation. It was a very involved, manual, process that consisted of reviewing a variety of different log formats from a mixture of devices and interfaces. No single tool or interface existed for incident and root cause analysis. This lead to an increased amount of time researching issues and building reports for senior management. Security investigation could take days if there was a low severity event to weeks if any events were deemed medium to high severity.Looked at traditional SIEMS and found them too bloated, required extensive resource and development time, and too expensiveNow have over 15 data sources going into Splunk and they created 3 custom Apps that have over 80 reports driven through 8 menus and 26 individual dashboards. Very easy for IT Security and others to use Splunk for security use cases. They also do real-time alerting on things like user privileges being escalated, possible data loss, and anomalous database activity. End result is the ROI listed here. Not listed here, but IT also uses Splunk for root cause analysis on key business applications and underlying storage systems. Also developers can access the log data to help them with troubleshooting.See ROI study at:http://www.splunk.com/web_assets/pdfs/secure/Splunk_at_Interac.pdf
• #83: Cisco, the global networking company. Their internal security team uses us. 7 clusters around globe, 900GB a day, 350TB stored data. (note – while Cisco has presented this info at numerous public events, and also blogged about it, please limit this information just to the customer you are presenting to – do not make public)Some logging and SIEM solutions we have used or evaluated required considerable effort to process custom formats (custom parsers, etc.)In our experience with SIEM 1 we found it to be rigid, inflexible, and difficult to customizeModifying how We like the ability to throw data of virtually any format/structure at our logging systemNo API/CLIFat java-based clientsOnly direct database access or worse, no alternative accessMaking scripting and automation more challengingIn the past, it wasn’t uncommon for regular reports and ad-hoc queries run against the SIEMs to take hours to completeCSIRT undertookreevaluation of logging/SIEM project in mid-2010 running a number of trials and proof of concepts, wrapping up in early 2011In CY12Q1 we retired the SIEM that had been in use since CY03 (NetIQ)Extensive migration project to replicate all existing playbook reports from SIEM in Splunk logging has been successful.Moved over 400 regularly scheduled reports from our SIEM into the new logging solution.Global logging solution deployed by end of CY11Also see:http://blogs.cisco.com/security/security-logging-in-an-enterprise-part-2-of-2/Based on sheer cost of deployment, we estimate that investment for a global logging solution was roughly 25% of what deploying a full SIEM would have cost usBegan mid-2010, completed early 2011Evaluated, trialed, Ran PoCs: Splunk and three other loggersSIEM 1 and six other SIEMsStrategy moving forward:Retire current SIEMUndertake global loggingEstimated: 25% of SIEM costOver 90% 0f the team is using the tool (where as before we primarily had analysts running reports)It is a great fit for the brand new analyst all the way up to the most seasoned investigatorsMuch higher percentage than SIEM 1 (which required logging in via a fat client or using direct DB access)With our revamped event collection deployment we are: Indexing over 35x the volume of data we were previouslyQuerying on average 20x fasterLong Queries:With SIEM 1: 2% over 1 hourWith Splunk: <0.5% over 1 hour
• #84: Barclays, the large financial services firm out of Europe. Use us for incident investigations, security dashboards (top malware sites employees visit, potentially infected endpoints), IT opps use cases as well.Needed a security logging and monitoring solution that could scale and was flexible for historical searches. (note – while Barclays has presented this info at numerous public events, and also discussed it in the media, please limit this information just to the customer you are presenting to – do not make public)Also see:http://www.computing.co.uk/ctg/news/2262548/without-splunk-we-might-be-taken-out-of-the-market-says-barclayshttp://www.computerweekly.com/news/2240183238/Barclays-indexes-machine-data-to-meet-complex-regulationhttp://www.computerworlduk.com/in-depth/applications/3442941/barclays-tackles-complex-regulatory-environment-with-splunk/
• #90: Infoblox is not a start-up. The company was started more than a dozen years ago – our technology is mature and field provenThe company HQ is in the heart of Silicon Valley with global operations in all major geographies – We do business in 3 regions (Americas, EMEA, APJ)We have sales, support and development operations in 25 countries and we do business in over 70 countries around the worldInfoblox makes essential technology to control networks – we’ll dig into that a bit later in theWe are a market leader in the space that we serve – with Strong Positive ratings from Gartner (3 years in a row) and 40% market share (Note: Gartner Market Scope and market share stat is specific to DDI)Infoblox has a massive customer base – our latest count is 6,900 different companies- we have shipped 64,000 systemsWe are innovative, with a formal patent program for our employees. As of right now we own 32 patents and 25 more pendingLast but not least – the company did a successful IPO in April 2012. We now share our financial results publicly – which can be seen on the right.
• #91: Infoblox can help organizations deal with the risks and expenses associated with key trends in the world of networks…Let’s take a look at how:Click: The modern network is made up of the infrastructure layer, which is all the devices you’re very familiar with (switches, routers, firewalls, load balancers, web proxy’s etc.)Click: These devices exist to support this layer – your Apps and Endpoints. Ranging from Voice Over IP Phones to tablets and smart phones, to all the VM’s and private clouds, all servicing the applications that drive the business.Click: Infoblox plays in the middle. In the control plane. We put our technology on high performance, highly available and secure platform (we call this the Grid). The grid has a very powerful, distributed network database that keeps all the information in one placeSo what does Infoblox do?Click: We deliver Discovery, Real-time Configuration & Change management, and compliance for this layerClick: And we deliver Essential Network Control functions like DNS, DHCP and IPAM (known as DDI) for this layerClick: Since we’re the new threat vectors are targeted at the network, specially the DNS architecture, we offers security solutions for risk mitigationAnd since we touch all these devices and capture real-time data in a single place…Click: we can do some amazing real-time and historical reporting as well as advanced control
• #92: Networks are constantly being exploited using DNS for a variety of criminal purposes today. DNS is the cornerstone of the internet and attackers know that DNS is a high-value target. Without their DNS functioning properly, enterprises cannot conduct business online. DNS protocol is stateless which means attackers also cannot be traced easily.The DNS protocol can be exploited easily. It is easy to craft DNS queries that can cause the DNS server to crash or respond with a much amplified response that can congest the bandwidth.The queries can be spoofed which means attackers can direct huge amounts of traffic to its victim with the help of unsuspecting accomplices. (open resolvers on the internet)All these reasons make the DNS an ideal attack target.
• #93: We are a critical component of the customer infrastructure and a target for many of these attacks. Big issue using DNS as a open global communication mechanism that is not well secured..not a well protected channel. Customers can use our purpose built hardware and best practices to ensure infrastructure safe.Malware communicates using DNS to resolve the ahe name. Purpose-built secure hardware Common criteria certifiedRate limitingBest practices
• #96: Hacking of DNS servers is becoming more prevalent each day. For those bad actors with extensive hacking skills it’s a quick path to inflicting damage and getting a hold of mass amounts of traffic/users quickly. Just in the last 15 months there are have been hacks of DNS servers of LinkedIn, Google Malaysia, and MIT. Traffic to these sites, in the thousands of visitors per hour provide a great source of unwilling participants for Hackers.
• #98: Security – Purpose Built AppliancesInfoblox has design, built and delivered hardened appliances from which secured DNS, DHCP, and IP Address management applications are delivered.For the appliances Infoblox has delivered:Minimal Attack Surface (Task specific hardware) – No extra or unused ports that could be used to access OS or power external devices – e.g. USB port for Wi-Fi access port.Active/Active HA & DR recoverySimple VRRP-based HA setup – Fail-over and fail-back to ensure availability.Active/active DR recovery – Ensure operations during a DisasterTested & certified to highest Industry standardsCommon Criteria EAL-2 Cert. – Hardware/software and manufacturing processes verified.FIPS 140-2 certificationSecure Inter-appliance communication128-bit AES Grid VPN comm. – All cross appliance communication is protected and cannot be intercepted.Centralized management with role-based controlCentral view of all appliances/processes & management.Role-based admin controls – Segment access, control, and management of applications or networks.Secured Access, communication & API6 authentication methodsTwo factor Auth. (CAC/PKI)HTTPS Web access – Secured accessSSL-Based REST/Perl APIGSS-TSIG & TSIGDetailed audit logging – For tracking of changes and enabling un-do of incorrect changes.Fast/easy upgrades – Reduce downtime and risk of upgrades.** NOT ON SLIDE **Restrictive/hardened Linux OS – hardened OS. Non-essential processes not enabled.Root access disabled – Control over operations cannot be compromised.
• #99: DNSSEC in 1-clickNo scripts / Auto-Resigning / 1-clickCentral configuration of all DNSSEC parametersAutomatic maintenance of signed zones
• #101: Arbor survey: This year Arbor collected 220 responses to the Infrastructure Security Survey, November 2012 to October 2013
• #103: The Adv Appliance can sit on the Grid. Now let’s see the Advanced DNS Protection in action. Regular GRID appliances like the GRID master and the reporting server sit on the GRIDLet’s assume we have two Advanced Appliances, one external authoritative and the other functioning as an internal recursive server. DNS attacks come interspersed with legitimate DNS traffic at the external authoritative server.Advanced DNS Protection pre-processes the requests to filter out attacksIt responds to legitimate DNS requestsThe attack types and patterns are sent to Infoblox Reporting server When Infoblox detects new threats, it creates rules and updates the Advanced Appliance. The rule updates are propagated to other Advanced Appliances on the Grid.
• #104: Here’s a high level categorization of the attacks that the Advanced DNS Protection protects against. These are just a high level categorization and there are several rules that are created of each of these attack types. Some of the key attacks we have seen growing in number in the last year or so are the DrDoS attacks that use a combination of reflection from multiple open recursive servers on the internet and amplification to really flood the target victim’s server.The reflection, amplification, floods all cause huge amounts of traffic to be sent to the target victim overwhelming the target server and eventually leading to a Denial of Service(DoS) attack.Detailed explanation of attacks (if more info is needed):DNS reflection/DrDoS attacks Reflection attacks are attacks that use a third party DNS server, mostly an open resolver, in the internet to propagate a DDoS attack on the victim’s server. A recursive server will process queries from any IP address and return responses. An attacker spoofs the DNS queries he sends to the recursive server by including the victim’s IP address as the source IP in the queries. So when the recursive name server receives the requests, it sends all the responses to the victim’s IP address. DrDoS or Distributed Reflection Denial of Service uses multiple such “host” machines or open resolvers in the internet, often thousands of servers, to launch an attack on the target victim. Amplification (described in the next row) can also be used while generating these queries to increase the impact on the victim. A high volume of such “reflected” traffic could overwhelm the victim server and bring down the victim’s site, thereby creating a Denial of Service (DoS).DNS amplification DNS amplification is an attack where a large number of specially crafted DNS queries are sent to the victim server. These specially crafted queries result in a very large response that can reach up to 70 times the size of the request. Since DNS relies on the User Datagram Protocol (UDP), the attacker can use a small volume of outbound traffic to cause the DNS server to generate a much larger volume. When the victim tries to respond to these specially crafted queries, the amplification congests the DNS server’s outbound bandwidth. This results in a Denial of Service (DoS). DNS-based exploits These are attacks that exploit vulnerabilities in the DNS software. This causes the DNS software to terminate abnormally, causing the server to stop responding or crash. TCP/UDP/ICMP floods These are volumetric attacks with massive numbers of packets that consume a network’s bandwidth and resources. TCP SYN floods consist of large volumes of half-opened TCP connections. This attack takes advantage of the way TCP establishes connections. The attacking software generates spoofed packets that appear to the server to be valid new connections. These packets enter the queue, but the connection is never completed—leaving false connections in the queue until they time out. The system under attack quits responding to new connections until the attack stops. This means the server is not responding to legitimate requests from clients to open new connections, resulting in a Denial of Service (DoS). UDP floods send large numbers of UDP packets to random ports on a remote server, which checks for applications listening to the port but doesn’t find them. The remote server is then forced to return a large number of ICMP Destination Unreachable packets to the attacker saying that the destination is unreachable. The attacker can also spoof the return IP address so that the replies don’t go to the attacker’s servers. Sending the replies exhausts the victim server’s resources and causes it to become unreachable. ICMP attacks use network devices like routers to send error messages when a requested service is not available or the remote server cannot be reached. Examples of ICMP attacks include ping floods, ping-of-death and smurf attacks. This overwhelms the victim server or causes it to crash due to overflow of memory buffers DNS cache poisoning Corruption of DNS cache data. It involves inserting a false address record for an Internet domain into the DNS query. If the DNS server accepts the record, subsequent requests for the address of the domain are answered with the address of a server controlled by the attacker. For as long as the false entry is cached, incoming web requests and emails will go to the attacker’s address. New cache-poisoning attacks such as the “birthday paradox” use brute force, flooding DNS responses and queries at the same time, hoping to get a match on one of the responses and poison the cache. Cache poisoning prevents access or redirects the clients to a rogue address, preventing legitimate users from accessing the company’s site. Inducing a name server to cache bogus resource recordsCan redirect…web browsers to bogus replicas of web sites, where logins, passwords and credit card numbers are capturedemail to hostile mail servers, where mail can be recorded or modifiedProtocol anomalies Send malformed DNS packets, including unexpected header and payload values, to the targeted server. They make use of software bugs in protocol parsing and processing implementation. The victim server stops responding by going into an infinite loop or crashes. Reconnaissance This attack consists of attempts to get information on the network environment before launching a large DDoS or other type of attack. Techniques include port scanning and finding versions and authors. These attacks exhibit abnormal behavior patterns that, if identified, can provide early warning. No direct effect on the server but indicates an impending attack. DNS tunneling This attack involves tunneling another protocol through DNS port 53—which is allowed if the firewall is configured to carry non-DNS traffic—for the purposes of data exfiltration. A free ISC-licensed tunneling application for forwarding IPv4 traffic through DNS servers is widely used in this kind of attack.
• #105: Enterprises can deploy the Adv DNS Protection either as an external authoritative server or a recursive/caching server inside their network. This diagram shows a typical deployment scenario in the external case and in the internal case. The first scenario helps to protect the network from external internet borne attacks that target the authoritative DNS. The second scenario is more common in education vertical where the university traffic can be as bad as the internet traffic. So Universities’ IT departments can use the Adv DNS Protection for their internal DNS server to ensure that the internal network is protected from attacks launched from within their network.
• #107: Before we talk about disrupting Malware which maybe random or targeted we need to understand the problem first. The problem is malware is used to drive security breaches around sensitive information or to steal money.Before you on the screen right now is just some of the breaches from CQ’ 2013 into CQ1’ 2014 that used Malware extensively. Let me go through a couple of examples. In the 1st quarter, the NY Times was hacked and information exfiltrated over a period of 4 months. An outside company was brought in at great expense to clean up the NY Times infrastructure. The outside vendor found 45 different malware instances only 1 of which was caught by Anti-Virus. Another example in the 1st quarter is Facebook. Facebook was infected via a Java-based malware that was accidentally download by several Facebook employees outside of the Facebook network and brought back into the network. Facebook found the Java-based malware because a DNS administrator found a sudden burst of DNS requests for domains in Russia.In the 2nd quarter it was announced that Malware was used to steal credit card numbers and other information from the likes of VISA, JC Penneys, NASDAQ and Carrefour which totaled $300 million. In the 3rd quarter of this year Adobe was hacked using malware and a outside security researcher discovered the breach when he found source code for 4 of Adobe’s products on a known hacker website.Finally – Retail was big target in late CQ4’ 2013 and early CQ’2014. Neiman Marcus, Target and several others were breached and credit card information for tens of millions were stolen. Target, Neiman Marcus, URM Stores (Washington State) found that their Credit Card Point-of-Sale (Windows) computers were breached and customer credit card data stolen. Each vendor had to announce it publicly. The impact on their business was 3-fold. (1) Customers shopped elsewhere because they lost faith in the retailers. (2) They also had to hire a 3rd party vendor to do forensics on their environment to find out what happened.(3) IT lost productivity because all servers and POS systems had to checked, updated and cleaned.
• #108: Here is one more example of Malware that DNS Firewall is effective against. Cryptolocker is a new name for a piece of malware (so called Ransomware) that has been updated and is now back in distribution.CryptoLocker is a Windows-based that is spread via various “pay per infection” methods. That is the crooks pay other crooks to infect you. Currently it is being spread by at least two different ways. One is email where the attached Malware is disguised as a PDF or voice-mail audio file. A second is via trojans already present on the machine which are commanded to download cryptolocker. Once CryptoLocker is on a Windows machine it enrypts the files on the local hard drive or shared drives by getting a encryption key from a internet based server. The encryption key is a 2048-bit RSA key. As you can see on the screen a pop-up windows informs you that your files are encrypted and you have 72 or 100 hours to pay $300 dollars or Euro’s to get access to your data. The only way to stop the encryption process is block access to the Encryption servers on the Internet. Infoblox DNS Firewall disrupts CryptoLocker by blocking DNS queries to the Encryption servers.
• #109: Infoblox DNS Firewall – How does it work?1. An infected mobile device is brought into the office. Upon connection, the malware starts to spread to other devices on the network.2. The malware makes a DNS query for “bad” domain to find “home.” The DNS Firewall has the “bad” domain in its table and blocks the connection.3. The DNS Server is continually updated by a reputational data feed service to reflect the rapidly changing list of malicious domains. 4. Infoblox Reporting provides list of blocked attempts as well as the IP addressMAC addressDevice type (DHCP fingerprint)Host NameDHCP Lease history (on/off network)5. Reputation data comes from:Infoblox DNS Firewall Subscription Service – blocking data on domains and IP addresses from 35+ sources throughout the world. Geo-blocking also apart of the service as wellInfoblox DNS Firewall – FireEye Adapter – APT malware domains and IP addresses to be blocked communicated to DNS Firewall from from FireEye NX Series.
• #111: What Protection does DNS Firewall Provide?DGA (Domain Generating Algorithm) - malware that randomly generates domains to connect to malicious networks or botnets. Initial infection seeking to connect and down load more software.Fast Flux - Rapidly changing of domains & IP addresses by malicious domains to obfuscate identity and locationAPT / Malware – Targeted attack APT / Malware designed to spread, morph and hide within IT infrastructure to perpetrate a long term attack. Integration with FireEye enables DNS Firewall to protect against APT.DNS Hijacking - Hijacking DNS registry(s) & re-directing users to malicious domain(s). Example of this is the Syrian Electronic Army hijacking of DNS servers in Australia and directing NY Times and Twitter users to their malicious domains.Geo-Blocking - Blocking access to geographies that have rates of malicious domains or Economic Sanctions by US Government. Ideal for governments and small business that don’t do business overseas and therefore users would not have a legitimate reason to be going to a domain hosted in this country. Examples of regions with high ratio of malicious domains (Russia, Moldova, Lithuania, most countries in Africa, etc.). A good example of how Geo-blocking helps – Cryptolocker – DNS Firewall with DNS Firewall Subscription service with Geo-blocks for Eastern Europe provides ZERO-Day protection against Cryptolocker.
• #112: DNSSEC enablement with automated key maintenance simplifies implementation and reduces risk
• #113: This concludes the Infoblox Webinar - Protect DNS from Being an Accomplice to Malware. We hope it has been informative for you.If you’d like to find out more you can:Contact Infoblox Sales at [email protected] or go to the infoblox website at www.infoblox.com
• #115: Key Message – Our Security Portfolio is focused on the question of how to secure core infrastructure. We deliver Security by focusing on next generation technologies & adaptive defensive techniques. Our experience in this space has shown us that threats are evolving very rapidly, and our approach emphasizes using leading next gen technologies rather than large, monolithic architectures, allowing you to react quickly to changes as they evolve. We back that up with industry leading expertise – we are the only authorized training centre in Canada for next-gen security technologies like Palo Alto Networks, F5 and Infoblox, leaders in their respective spaces. And we maintain technical & sales certifications with leading security companies including McAfee, Cisco.Key Partners & Technologies - Palo Alto, Fortinet, FireEye, McAfee, Cisco, F5, InfobloxProtection & DefenceThe first line of defence is to stop unwanted intrusions & attacks so that they never penetrate your network. Scalar can design and deliver solutions to protect your network and applications, control your DNS & IP address properties and control user activity while ensuring speed and performance are maintained. Incident & Event ManagementWhile protection is critical, it’s equally as important to deliver a rapid, effective & coordinated response to any intrusion or attack. That requires processes, discipline and tools, including a 24/7 Security Operations Centre with the staff & training to operate it. That’s how Scalar helps customers secure hundreds of endpoints, devices and networks. Threat Assessment & Penetration TestingImproving your security posture means you need to understand where your vulnerabilities are. A vulnerability assessment can not only identify vulnerabilities in a system, but can help prioritize & rank the order in which they should be fixed, and educate internal stakeholders of the potential risks that exist. And while online tools exist, interpreting the results and developing a plan can be overwhelming for IT departments that lack the staff with the necessary skills. Scalar can conduct the assessments, and our analysts can work with you to develop a plan to close potential threats.
• #116: SEIM is only as good as the people that deploy and the processes that manage it- URL Filtering Data typically shows up late- Different types. Multiple vendors or similar technologies (firewalls from different vendors- Other data types. Vulnerability data, Physical Security systems
• #117: InfoSec Staff are expensiveThey are smart and ambitious As soon as they are trained they leave…They have, in some cases, very granular skillsFacilities costs Labs, tools (IDA Pro, Responder Pro, Encase)
• #118: Vulnerability Management is a continuous process that must have measurable results. It is not solely about patching or fixing vulnerabilities. It is about managing part of your business. It is about auditable results.-Needs to be continuous processRequires an advanced knowledge of vulnerabilities and patching as well as server hardening. Not all vulnerabilities are patch related. Compliance and other types of issuesDealing with zero days Assessing risk
• #119: APT is a very overused term these days. It is THE problem but does not explain how to resolve it. It is resolved with state-of-the-art technology deployed in the right place and managed by the right people who understand how to interpret the results and action them in the correct priority.Infected devices video cables etcWhoNeiman Marcus 60K events triggered but these were probably just noise inside millions of events.NSA ANT TAO Tailored Access Operations
• #120: Key Message – Our Security Portfolio is focused on the question of how to secure core infrastructure. We deliver Security by focusing on next generation technologies & adaptive defensive techniques. Our experience in this space has shown us that threats are evolving very rapidly, and our approach emphasizes using leading next gen technologies rather than large, monolithic architectures, allowing you to react quickly to changes as they evolve. We back that up with industry leading expertise – we are the only authorized training centre in Canada for next-gen security technologies like Palo Alto Networks, F5 and Infoblox, leaders in their respective spaces. And we maintain technical & sales certifications with leading security companies including McAfee, Cisco.Key Partners & Technologies - Palo Alto, Fortinet, FireEye, McAfee, Cisco, F5, InfobloxProtection & DefenceThe first line of defence is to stop unwanted intrusions & attacks so that they never penetrate your network. Scalar can design and deliver solutions to protect your network and applications, control your DNS & IP address properties and control user activity while ensuring speed and performance are maintained. Incident & Event ManagementWhile protection is critical, it’s equally as important to deliver a rapid, effective & coordinated response to any intrusion or attack. That requires processes, discipline and tools, including a 24/7 Security Operations Centre with the staff & training to operate it. That’s how Scalar helps customers secure hundreds of endpoints, devices and networks. Threat Assessment & Penetration TestingImproving your security posture means you need to understand where your vulnerabilities are. A vulnerability assessment can not only identify vulnerabilities in a system, but can help prioritize & rank the order in which they should be fixed, and educate internal stakeholders of the potential risks that exist. And while online tools exist, interpreting the results and developing a plan can be overwhelming for IT departments that lack the staff with the necessary skills. Scalar can conduct the assessments, and our analysts can work with you to develop a plan to close potential threats.