SlideShare a Scribd company logo

Building the Security Operations and SIEM Use CAse

Don Murdoch GSE CyberGuardian CISSP
Don Murdoch GSE CyberGuardian CISSP

Use Cases are a formal technique taught in most IS/IT disciplines. This presentation discusses a model to take that methodology and apply it to developing Security Operations and SIEM focused uses cases. The template discussed is in use at a major SIEM provider today, and is based on 10 years of implementing SIEM and building up SecOps across 15+ organizations over 10 years.

1 of 20
Downloaded 23 times
1© 2018 Don Murdoch / SANS Security Operations Summit, 2018 1 SecOps, SIEM, and Security Architecture Use Case Development Don Murdoch, GSE #99 Asst. Director, Institute for Cyber Security, Regent University, Virginia Beach, VA Author, Blue Team Handbook: Incident Response Latin "sapere aude" means "Dare to Be Wise"
© 2018 Don Murdoch / SANS Security Operations Summit, 2018 2 Session Agenda • Requirements development in support of SecOps/SecArch focused use cases • Define the security operations use case development process and key considerations • Provide real life examples from a SIEM platforms and custom implementations
© 2018 Don Murdoch / SANS Security Operations Summit, 2018 3 Requirements – Spot the need vs. feature Needs: Things that the stakeholders believe that the system needs to do; problems that they need to have solved. Features: Informal / imprecise statements of capabilities of the system used often for marketing and product-positioning purposes, as a shorthand for a set of behaviors of the system.
© 2018 Don Murdoch / SANS Security Operations Summit, 2018 4 Requirements Development is Essential • Software development goal • Develop [acceptable] quality software, on time and on budget that meets a real need • Satisfy Requirements, or the individual statements of conditions and capabilities to which the system must conform • Use Cases express and show how to realize the requirements • Studies advise: • 50% of businesses experience IT [cloud] project failure (Innotas, 2013) • Only 16.2% of 8,360 software projects had ideal results (Standish, 2014)
© 2018 Don Murdoch / SANS Security Operations Summit, 2018 5 The Maturing Iron Triangle • Value- to the end user in terms of a deliverable product • Quality- continuous delivery of value according to the customer’s requirements • Constraints- a traditional scope, schedule and scope Source: https://www.knowledgehut.com/blog/agile-management/agile-project-management-triangle-a-golden-product-in-organizations Scope Cost Constraint (S,S,C) PMBOK Value (Extrinsic Quality) Agile Quality (Intrinsic)Schedule 1090’s -> 2010’s
© 2018 Don Murdoch / SANS Security Operations Summit, 2018 6 Use Cases Defined • Definition: • Actions or steps that define the interactions between a role and a system to achieve a specific goal. Roles are outside. • Actor: a person or things that interact with the system • Use Case: Things of value the system provides to its actors • SecOps: Use cases define the flow of data and how the Security Team interacts with the system to monitor and detect adverse conditions
© 2018 Don Murdoch / SANS Security Operations Summit, 2018 7 Phases SIEM/SecOps Process Understand business Need. What is the security question that must be answered? How is it tied to the value chain? Develop Requirements Guidance Tools, Frameworks (CISec, ASD 35, Regulatory, 800-53 etc.) Instrument Source System Develop SIEM Content Enable and Train SecOps Validation Cycle Operating Constraints: Can it be done? Does the source generate a consumable log? User ID? How can we collect the data? What enrichment helps?
© 2018 Don Murdoch / SANS Security Operations Summit, 2018 8 SecOps Use Case Template • Name • Purpose • Problem Statement • Requirement Statement(s) • Design Specification • Security Operations Notification Process and Key Data • Incident Response / Investigation Process for the Analyst • Use Case Component Names • Use Case Component Names • Use Case Data Source Descriptions • Data Analysis – Go Diamond • Kill Chain Analysis – Traditional KC – ICS Specific KC • Audit support • Assumptions / Limitations • Alternatives to this Use Case
© 2018 Don Murdoch / SANS Security Operations Summit, 2018 9 Be Wise Up Front (1/2) • Name – placeholder in the library, control tie in • Purpose • To describe a specific use case for topic X and explain how the UC will be satisfied by system Y • Problem Statement • Describe the business objective / process / problem • Provide direction without stating a solution • Ideally, it expresses a solvable problem
© 2018 Don Murdoch / SANS Security Operations Summit, 2018 10 Be Wise Up Front (2/2) • Requirements – Correct, unambiguous, and feasible – Must support the use case – in scope – Ideally, requirements communicate priority. – Measurable or verifiable in some way which will manifest through the source data and actions that the system will take. – Testable (design of experiment)
© 2018 Don Murdoch / SANS Security Operations Summit, 2018 11 Use SMART Design Specifications • Specific – target a specific area. • Measurable – quantify an indicator of progress. • Assignable – specify who, what, where • Realistic – state what results can realistically be achieved, given available resources • Time-related – specify when the result(s) can be achieved. • Because Use Cases need to be successful too!
© 2018 Don Murdoch / SANS Security Operations Summit, 2018 12 Sec Ops Team Notification – Key Actors • Ensure that all necessary data arrives to the SoC – Enrichment is important for SoC analyst success – Automate as much as possible for rapid review • Provide process guidance for content context – A note to explain the “attribute” – Define further analyst investigation paths / opening move to shorten the MTTD (detect)
© 2018 Don Murdoch / SANS Security Operations Summit, 2018 13 Component Names – Maintenance • Document the Use Case components for the “entire system” • Data feeds, plug ins, configuration files, parsers, normalizers • Device names • Rules, lists, directives, enrichment/reference sources • Content components such as internal lists, dashboards, output reports, etc. • This section is critical for “debugging”
© 2018 Don Murdoch / SANS Security Operations Summit, 2018 14 Example UC’s for Account Misuse and ALCE’s – Audit Logon and Account Logon • AD DDGPO, DDC GPO, Local GPO – is this thing on? • Log reader – every X Seconds, read and forward • Alert notification must be able to parse and identify the condition – Constituent system policy - “defer” to the central directory for account name and needs to log attempts – Privileged “security context” (group) changes
© 2018 Don Murdoch / SANS Security Operations Summit, 2018 15 Data Process – Windows Event Logs Windows Event Log Local Audit Policy Consumer (Nxlog, WMI, OSSEC, WinLogBeats Proprietary) Normalization, Enrichment, Apply Taxonomy Manager, analysis engine, Alert Gen AD Adv. Audit Policy Security Analyst How many opportunities are there for the system to break down? Context Clues!
© 2018 Don Murdoch / SANS Security Operations Summit, 2018 16 Instrument and test the system!
© 2018 Don Murdoch / SANS Security Operations Summit, 2018 17 SIEM Example - Privileged Group Changes Can you find the gap? 4728: A member was added to a security-enabled global group
© 2018 Don Murdoch / SANS Security Operations Summit, 2018 18 How “we” spent 204 hours or $13,872 to “monitor PeopleSoft HCMS and FIN” • Multilevel security rights/roles model – 67 pages • Design 17 conditions to satisfy Financial Controls • 17 select’s that rolled into one, 17 unit tests, meetings.. • 24 page BRD, 70+ page DD, 17 step test plan, 6 Stored procedures and collectors, rights, deployments (Q,D,P) with change control • Custom collector codebase – one per environment - multiple dashboards, two email notifications, audit report – Ensure you predict prod impact because Dev and QA will not mimic production while you design/develop
© 2018 Don Murdoch / SANS Security Operations Summit, 2018 19 Hundreds of Other Use Cases • Accounts not conformant to standards or in use in a constituent system but not defined in the central directory • Successful brute force • Local A/V event followed by outbound URL to suspicious IP and a PDF file open on the PC • Proxy says “Suspect site”, then AV event, then ‘first IP use without prior DNS lookup’
20© 2018 Don Murdoch / SANS Security Operations Summit, 2018 20 Thank you!
Ad

Recommended

SOC Architecture Workshop - Part 1
SOC Architecture Workshop - Part 1SOC Architecture Workshop - Part 1
SOC Architecture Workshop - Part 1
Priyanka Aash
 
Threat Hunting - Moving from the ad hoc to the formal
Threat Hunting - Moving from the ad hoc to the formalThreat Hunting - Moving from the ad hoc to the formal
Threat Hunting - Moving from the ad hoc to the formal
Priyanka Aash
 
Security Information and Event Managemen
Security Information and Event ManagemenSecurity Information and Event Managemen
Security Information and Event Managemen
S Periyakaruppan CISM,ISO31000,C-EH,ITILF
 
SOC presentation- Building a Security Operations Center
SOC presentation- Building a Security Operations CenterSOC presentation- Building a Security Operations Center
SOC presentation- Building a Security Operations Center
Michael Nickle
 
Strategy considerations for building a security operations center
Strategy considerations for building a security operations centerStrategy considerations for building a security operations center
Strategy considerations for building a security operations center
CMR WORLD TECH
 
Security operations center 5 security controls
Security operations center 5 security controls Security operations center 5 security controls
Security operations center 5 security controls
AlienVault
 
DTS Solution - Building a SOC (Security Operations Center)
DTS Solution - Building a SOC (Security Operations Center)DTS Solution - Building a SOC (Security Operations Center)
DTS Solution - Building a SOC (Security Operations Center)
Shah Sheikh
 
Security Operation Center Fundamental
Security Operation Center FundamentalSecurity Operation Center Fundamental
Security Operation Center Fundamental
Amir Hossein Zargaran
 
SOC: Use cases and are we asking the right questions?
SOC: Use cases and are we asking the right questions?SOC: Use cases and are we asking the right questions?
SOC: Use cases and are we asking the right questions?
Jonathan Sinclair
 
MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...
MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...
MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...
MITRE - ATT&CKcon
 
Cybersecurity Frameworks | NIST Cybersecurity Framework | Cybersecurity Certi...
Cybersecurity Frameworks | NIST Cybersecurity Framework | Cybersecurity Certi...Cybersecurity Frameworks | NIST Cybersecurity Framework | Cybersecurity Certi...
Cybersecurity Frameworks | NIST Cybersecurity Framework | Cybersecurity Certi...
Edureka!
 
What is Threat Hunting? - Panda Security
What is Threat Hunting? - Panda SecurityWhat is Threat Hunting? - Panda Security
What is Threat Hunting? - Panda Security
Panda Security
 
An introduction to SOC (Security Operation Center)
An introduction to SOC (Security Operation Center)An introduction to SOC (Security Operation Center)
An introduction to SOC (Security Operation Center)
Ahmad Haghighi
 
Threat Intelligence Workshop
Threat Intelligence WorkshopThreat Intelligence Workshop
Threat Intelligence Workshop
Priyanka Aash
 
Security Information and Event Management (SIEM)
Security Information and Event Management (SIEM)Security Information and Event Management (SIEM)
Security Information and Event Management (SIEM)
k33a
 
Optimizing Security Operations: 5 Keys to Success
Optimizing Security Operations: 5 Keys to SuccessOptimizing Security Operations: 5 Keys to Success
Optimizing Security Operations: 5 Keys to Success
Sirius
 
Security operation center (SOC)
Security operation center (SOC)Security operation center (SOC)
Security operation center (SOC)
Ahmed Ayman
 
Threat Hunting
Threat HuntingThreat Hunting
Threat Hunting
Splunk
 
Security Operation Center - Design & Build
Security Operation Center - Design & BuildSecurity Operation Center - Design & Build
Security Operation Center - Design & Build
Sameer Paradia
 
Cyber Threat Intelligence - It's not just about the feeds
Cyber Threat Intelligence - It's not just about the feedsCyber Threat Intelligence - It's not just about the feeds
Cyber Threat Intelligence - It's not just about the feeds
Iain Dickson
 
Security Operations Center (SOC) Essentials for the SME
Security Operations Center (SOC) Essentials for the SMESecurity Operations Center (SOC) Essentials for the SME
Security Operations Center (SOC) Essentials for the SME
AlienVault
 
What is SIEM? A Brilliant Guide to the Basics
What is SIEM? A Brilliant Guide to the BasicsWhat is SIEM? A Brilliant Guide to the Basics
What is SIEM? A Brilliant Guide to the Basics
Sagar Joshi
 
McAfee SIEM solution
McAfee SIEM solution McAfee SIEM solution
McAfee SIEM solution
hashnees
 
Welcome to the world of Cyber Threat Intelligence
Welcome to the world of Cyber Threat IntelligenceWelcome to the world of Cyber Threat Intelligence
Welcome to the world of Cyber Threat Intelligence
Andreas Sfakianakis
 
QRadar, ArcSight and Splunk
QRadar, ArcSight and Splunk QRadar, ArcSight and Splunk
QRadar, ArcSight and Splunk
M sharifi
 
INCIDENT RESPONSE NIST IMPLEMENTATION
INCIDENT RESPONSE NIST IMPLEMENTATIONINCIDENT RESPONSE NIST IMPLEMENTATION
INCIDENT RESPONSE NIST IMPLEMENTATION
Sylvain Martinez
 
Security operations center-SOC Presentation-مرکز عملیات امنیت
Security operations center-SOC Presentation-مرکز عملیات امنیتSecurity operations center-SOC Presentation-مرکز عملیات امنیت
Security operations center-SOC Presentation-مرکز عملیات امنیت
ReZa AdineH
 
7 Steps to Build a SOC with Limited Resources
7 Steps to Build a SOC with Limited Resources7 Steps to Build a SOC with Limited Resources
7 Steps to Build a SOC with Limited Resources
LogRhythm
 
Essential Prerequisites for Maximizing Success from Big Data
Essential Prerequisites for Maximizing Success from Big DataEssential Prerequisites for Maximizing Success from Big Data
Essential Prerequisites for Maximizing Success from Big Data
Society of Petroleum Engineers
 
Why Your Data Science Architecture Should Include a Data Virtualization Tool ...
Why Your Data Science Architecture Should Include a Data Virtualization Tool ...Why Your Data Science Architecture Should Include a Data Virtualization Tool ...
Why Your Data Science Architecture Should Include a Data Virtualization Tool ...
Denodo
 
Ad

More Related Content

What's hot (20)

SOC: Use cases and are we asking the right questions?
SOC: Use cases and are we asking the right questions?SOC: Use cases and are we asking the right questions?
SOC: Use cases and are we asking the right questions?
Jonathan Sinclair
 
MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...
MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...
MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...
MITRE - ATT&CKcon
 
Cybersecurity Frameworks | NIST Cybersecurity Framework | Cybersecurity Certi...
Cybersecurity Frameworks | NIST Cybersecurity Framework | Cybersecurity Certi...Cybersecurity Frameworks | NIST Cybersecurity Framework | Cybersecurity Certi...
Cybersecurity Frameworks | NIST Cybersecurity Framework | Cybersecurity Certi...
Edureka!
 
What is Threat Hunting? - Panda Security
What is Threat Hunting? - Panda SecurityWhat is Threat Hunting? - Panda Security
What is Threat Hunting? - Panda Security
Panda Security
 
An introduction to SOC (Security Operation Center)
An introduction to SOC (Security Operation Center)An introduction to SOC (Security Operation Center)
An introduction to SOC (Security Operation Center)
Ahmad Haghighi
 
Threat Intelligence Workshop
Threat Intelligence WorkshopThreat Intelligence Workshop
Threat Intelligence Workshop
Priyanka Aash
 
Security Information and Event Management (SIEM)
Security Information and Event Management (SIEM)Security Information and Event Management (SIEM)
Security Information and Event Management (SIEM)
k33a
 
Optimizing Security Operations: 5 Keys to Success
Optimizing Security Operations: 5 Keys to SuccessOptimizing Security Operations: 5 Keys to Success
Optimizing Security Operations: 5 Keys to Success
Sirius
 
Security operation center (SOC)
Security operation center (SOC)Security operation center (SOC)
Security operation center (SOC)
Ahmed Ayman
 
Threat Hunting
Threat HuntingThreat Hunting
Threat Hunting
Splunk
 
Security Operation Center - Design & Build
Security Operation Center - Design & BuildSecurity Operation Center - Design & Build
Security Operation Center - Design & Build
Sameer Paradia
 
Cyber Threat Intelligence - It's not just about the feeds
Cyber Threat Intelligence - It's not just about the feedsCyber Threat Intelligence - It's not just about the feeds
Cyber Threat Intelligence - It's not just about the feeds
Iain Dickson
 
Security Operations Center (SOC) Essentials for the SME
Security Operations Center (SOC) Essentials for the SMESecurity Operations Center (SOC) Essentials for the SME
Security Operations Center (SOC) Essentials for the SME
AlienVault
 
What is SIEM? A Brilliant Guide to the Basics
What is SIEM? A Brilliant Guide to the BasicsWhat is SIEM? A Brilliant Guide to the Basics
What is SIEM? A Brilliant Guide to the Basics
Sagar Joshi
 
McAfee SIEM solution
McAfee SIEM solution McAfee SIEM solution
McAfee SIEM solution
hashnees
 
Welcome to the world of Cyber Threat Intelligence
Welcome to the world of Cyber Threat IntelligenceWelcome to the world of Cyber Threat Intelligence
Welcome to the world of Cyber Threat Intelligence
Andreas Sfakianakis
 
QRadar, ArcSight and Splunk
QRadar, ArcSight and Splunk QRadar, ArcSight and Splunk
QRadar, ArcSight and Splunk
M sharifi
 
INCIDENT RESPONSE NIST IMPLEMENTATION
INCIDENT RESPONSE NIST IMPLEMENTATIONINCIDENT RESPONSE NIST IMPLEMENTATION
INCIDENT RESPONSE NIST IMPLEMENTATION
Sylvain Martinez
 
Security operations center-SOC Presentation-مرکز عملیات امنیت
Security operations center-SOC Presentation-مرکز عملیات امنیتSecurity operations center-SOC Presentation-مرکز عملیات امنیت
Security operations center-SOC Presentation-مرکز عملیات امنیت
ReZa AdineH
 
7 Steps to Build a SOC with Limited Resources
7 Steps to Build a SOC with Limited Resources7 Steps to Build a SOC with Limited Resources
7 Steps to Build a SOC with Limited Resources
LogRhythm
 
SOC: Use cases and are we asking the right questions?
SOC: Use cases and are we asking the right questions?SOC: Use cases and are we asking the right questions?
SOC: Use cases and are we asking the right questions?
Jonathan Sinclair
 
MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...
MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...
MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...
MITRE - ATT&CKcon
 
Cybersecurity Frameworks | NIST Cybersecurity Framework | Cybersecurity Certi...
Cybersecurity Frameworks | NIST Cybersecurity Framework | Cybersecurity Certi...Cybersecurity Frameworks | NIST Cybersecurity Framework | Cybersecurity Certi...
Cybersecurity Frameworks | NIST Cybersecurity Framework | Cybersecurity Certi...
Edureka!
 
What is Threat Hunting? - Panda Security
What is Threat Hunting? - Panda SecurityWhat is Threat Hunting? - Panda Security
What is Threat Hunting? - Panda Security
Panda Security
 
An introduction to SOC (Security Operation Center)
An introduction to SOC (Security Operation Center)An introduction to SOC (Security Operation Center)
An introduction to SOC (Security Operation Center)
Ahmad Haghighi
 
Threat Intelligence Workshop
Threat Intelligence WorkshopThreat Intelligence Workshop
Threat Intelligence Workshop
Priyanka Aash
 
Security Information and Event Management (SIEM)
Security Information and Event Management (SIEM)Security Information and Event Management (SIEM)
Security Information and Event Management (SIEM)
k33a
 
Optimizing Security Operations: 5 Keys to Success
Optimizing Security Operations: 5 Keys to SuccessOptimizing Security Operations: 5 Keys to Success
Optimizing Security Operations: 5 Keys to Success
Sirius
 
Security operation center (SOC)
Security operation center (SOC)Security operation center (SOC)
Security operation center (SOC)
Ahmed Ayman
 
Threat Hunting
Threat HuntingThreat Hunting
Threat Hunting
Splunk
 
Security Operation Center - Design & Build
Security Operation Center - Design & BuildSecurity Operation Center - Design & Build
Security Operation Center - Design & Build
Sameer Paradia
 
Cyber Threat Intelligence - It's not just about the feeds
Cyber Threat Intelligence - It's not just about the feedsCyber Threat Intelligence - It's not just about the feeds
Cyber Threat Intelligence - It's not just about the feeds
Iain Dickson
 
Security Operations Center (SOC) Essentials for the SME
Security Operations Center (SOC) Essentials for the SMESecurity Operations Center (SOC) Essentials for the SME
Security Operations Center (SOC) Essentials for the SME
AlienVault
 
What is SIEM? A Brilliant Guide to the Basics
What is SIEM? A Brilliant Guide to the BasicsWhat is SIEM? A Brilliant Guide to the Basics
What is SIEM? A Brilliant Guide to the Basics
Sagar Joshi
 
McAfee SIEM solution
McAfee SIEM solution McAfee SIEM solution
McAfee SIEM solution
hashnees
 
Welcome to the world of Cyber Threat Intelligence
Welcome to the world of Cyber Threat IntelligenceWelcome to the world of Cyber Threat Intelligence
Welcome to the world of Cyber Threat Intelligence
Andreas Sfakianakis
 
QRadar, ArcSight and Splunk
QRadar, ArcSight and Splunk QRadar, ArcSight and Splunk
QRadar, ArcSight and Splunk
M sharifi
 
INCIDENT RESPONSE NIST IMPLEMENTATION
INCIDENT RESPONSE NIST IMPLEMENTATIONINCIDENT RESPONSE NIST IMPLEMENTATION
INCIDENT RESPONSE NIST IMPLEMENTATION
Sylvain Martinez
 
Security operations center-SOC Presentation-مرکز عملیات امنیت
Security operations center-SOC Presentation-مرکز عملیات امنیتSecurity operations center-SOC Presentation-مرکز عملیات امنیت
Security operations center-SOC Presentation-مرکز عملیات امنیت
ReZa AdineH
 
7 Steps to Build a SOC with Limited Resources
7 Steps to Build a SOC with Limited Resources7 Steps to Build a SOC with Limited Resources
7 Steps to Build a SOC with Limited Resources
LogRhythm
 

Similar to Building the Security Operations and SIEM Use CAse (20)

Essential Prerequisites for Maximizing Success from Big Data
Essential Prerequisites for Maximizing Success from Big DataEssential Prerequisites for Maximizing Success from Big Data
Essential Prerequisites for Maximizing Success from Big Data
Society of Petroleum Engineers
 
Why Your Data Science Architecture Should Include a Data Virtualization Tool ...
Why Your Data Science Architecture Should Include a Data Virtualization Tool ...Why Your Data Science Architecture Should Include a Data Virtualization Tool ...
Why Your Data Science Architecture Should Include a Data Virtualization Tool ...
Denodo
 
A Study in Borderless Over Perimeter
A Study in Borderless Over PerimeterA Study in Borderless Over Perimeter
A Study in Borderless Over Perimeter
ForgeRock
 
Embedded Security and the IoT – Challenges, Trends and Solutions
Embedded Security and the IoT – Challenges, Trends and SolutionsEmbedded Security and the IoT – Challenges, Trends and Solutions
Embedded Security and the IoT – Challenges, Trends and Solutions
Real-Time Innovations (RTI)
 
GDPR Noncompliance: Avoid the Risk with Data Virtualization
GDPR Noncompliance: Avoid the Risk with Data VirtualizationGDPR Noncompliance: Avoid the Risk with Data Virtualization
GDPR Noncompliance: Avoid the Risk with Data Virtualization
Denodo
 
Nist cybersecurity framework isc2 quantico
Nist cybersecurity framework isc2 quanticoNist cybersecurity framework isc2 quantico
Nist cybersecurity framework isc2 quantico
Tuan Phan
 
PayPal Decision Management Architecture
PayPal Decision Management ArchitecturePayPal Decision Management Architecture
PayPal Decision Management Architecture
Pradeep Ballal
 
Security Ops for large and small companies
Security Ops for large and small companiesSecurity Ops for large and small companies
Security Ops for large and small companies
Mona Arkhipova
 
Introduction to NIST Cybersecurity Framework
Introduction to NIST Cybersecurity FrameworkIntroduction to NIST Cybersecurity Framework
Introduction to NIST Cybersecurity Framework
Tuan Phan
 
Implementar una estrategia eficiente de gobierno y seguridad del dato con la ...
Implementar una estrategia eficiente de gobierno y seguridad del dato con la ...Implementar una estrategia eficiente de gobierno y seguridad del dato con la ...
Implementar una estrategia eficiente de gobierno y seguridad del dato con la ...
Denodo
 
Decision Matrix for IoT Product Development
Decision Matrix for IoT Product DevelopmentDecision Matrix for IoT Product Development
Decision Matrix for IoT Product Development
Alexey Pyshkin
 
Identifying Effective Endpoint Detection and Response Platforms (EDRP)
Identifying Effective Endpoint Detection and Response Platforms (EDRP)Identifying Effective Endpoint Detection and Response Platforms (EDRP)
Identifying Effective Endpoint Detection and Response Platforms (EDRP)
Enterprise Management Associates
 
IT OT Integration_Vishnu_Murali_05262016_UPDATED
IT OT Integration_Vishnu_Murali_05262016_UPDATEDIT OT Integration_Vishnu_Murali_05262016_UPDATED
IT OT Integration_Vishnu_Murali_05262016_UPDATED
Vishnu Murali
 
RSA Conference Presentation–Creating a Modern AppSec Toolchain to Quantify Se...
RSA Conference Presentation–Creating a Modern AppSec Toolchain to Quantify Se...RSA Conference Presentation–Creating a Modern AppSec Toolchain to Quantify Se...
RSA Conference Presentation–Creating a Modern AppSec Toolchain to Quantify Se...
Synopsys Software Integrity Group
 
Time to re think our security process
Time to re think our security processTime to re think our security process
Time to re think our security process
Ulf Mattsson
 
Comodo SOC service provider
Comodo SOC service providerComodo SOC service provider
Comodo SOC service provider
paulharry03
 
Unlocking Engineering Observability with advanced IT analytics
Unlocking Engineering Observability with advanced IT analyticsUnlocking Engineering Observability with advanced IT analytics
Unlocking Engineering Observability with advanced IT analytics
source{d}
 
A Logical Architecture is Always a Flexible Architecture (ASEAN)
A Logical Architecture is Always a Flexible Architecture (ASEAN)A Logical Architecture is Always a Flexible Architecture (ASEAN)
A Logical Architecture is Always a Flexible Architecture (ASEAN)
Denodo
 
When and How Data Lakes Fit into a Modern Data Architecture
When and How Data Lakes Fit into a Modern Data ArchitectureWhen and How Data Lakes Fit into a Modern Data Architecture
When and How Data Lakes Fit into a Modern Data Architecture
DATAVERSITY
 
AFAC session 2 - September 8, 2014
AFAC session 2 - September 8, 2014AFAC session 2 - September 8, 2014
AFAC session 2 - September 8, 2014
KBIZEAU
 
Essential Prerequisites for Maximizing Success from Big Data
Essential Prerequisites for Maximizing Success from Big DataEssential Prerequisites for Maximizing Success from Big Data
Essential Prerequisites for Maximizing Success from Big Data
Society of Petroleum Engineers
 
Why Your Data Science Architecture Should Include a Data Virtualization Tool ...
Why Your Data Science Architecture Should Include a Data Virtualization Tool ...Why Your Data Science Architecture Should Include a Data Virtualization Tool ...
Why Your Data Science Architecture Should Include a Data Virtualization Tool ...
Denodo
 
A Study in Borderless Over Perimeter
A Study in Borderless Over PerimeterA Study in Borderless Over Perimeter
A Study in Borderless Over Perimeter
ForgeRock
 
Embedded Security and the IoT – Challenges, Trends and Solutions
Embedded Security and the IoT – Challenges, Trends and SolutionsEmbedded Security and the IoT – Challenges, Trends and Solutions
Embedded Security and the IoT – Challenges, Trends and Solutions
Real-Time Innovations (RTI)
 
GDPR Noncompliance: Avoid the Risk with Data Virtualization
GDPR Noncompliance: Avoid the Risk with Data VirtualizationGDPR Noncompliance: Avoid the Risk with Data Virtualization
GDPR Noncompliance: Avoid the Risk with Data Virtualization
Denodo
 
Nist cybersecurity framework isc2 quantico
Nist cybersecurity framework isc2 quanticoNist cybersecurity framework isc2 quantico
Nist cybersecurity framework isc2 quantico
Tuan Phan
 
PayPal Decision Management Architecture
PayPal Decision Management ArchitecturePayPal Decision Management Architecture
PayPal Decision Management Architecture
Pradeep Ballal
 
Security Ops for large and small companies
Security Ops for large and small companiesSecurity Ops for large and small companies
Security Ops for large and small companies
Mona Arkhipova
 
Introduction to NIST Cybersecurity Framework
Introduction to NIST Cybersecurity FrameworkIntroduction to NIST Cybersecurity Framework
Introduction to NIST Cybersecurity Framework
Tuan Phan
 
Implementar una estrategia eficiente de gobierno y seguridad del dato con la ...
Implementar una estrategia eficiente de gobierno y seguridad del dato con la ...Implementar una estrategia eficiente de gobierno y seguridad del dato con la ...
Implementar una estrategia eficiente de gobierno y seguridad del dato con la ...
Denodo
 
Decision Matrix for IoT Product Development
Decision Matrix for IoT Product DevelopmentDecision Matrix for IoT Product Development
Decision Matrix for IoT Product Development
Alexey Pyshkin
 
Identifying Effective Endpoint Detection and Response Platforms (EDRP)
Identifying Effective Endpoint Detection and Response Platforms (EDRP)Identifying Effective Endpoint Detection and Response Platforms (EDRP)
Identifying Effective Endpoint Detection and Response Platforms (EDRP)
Enterprise Management Associates
 
IT OT Integration_Vishnu_Murali_05262016_UPDATED
IT OT Integration_Vishnu_Murali_05262016_UPDATEDIT OT Integration_Vishnu_Murali_05262016_UPDATED
IT OT Integration_Vishnu_Murali_05262016_UPDATED
Vishnu Murali
 
RSA Conference Presentation–Creating a Modern AppSec Toolchain to Quantify Se...
RSA Conference Presentation–Creating a Modern AppSec Toolchain to Quantify Se...RSA Conference Presentation–Creating a Modern AppSec Toolchain to Quantify Se...
RSA Conference Presentation–Creating a Modern AppSec Toolchain to Quantify Se...
Synopsys Software Integrity Group
 
Time to re think our security process
Time to re think our security processTime to re think our security process
Time to re think our security process
Ulf Mattsson
 
Comodo SOC service provider
Comodo SOC service providerComodo SOC service provider
Comodo SOC service provider
paulharry03
 
Unlocking Engineering Observability with advanced IT analytics
Unlocking Engineering Observability with advanced IT analyticsUnlocking Engineering Observability with advanced IT analytics
Unlocking Engineering Observability with advanced IT analytics
source{d}
 
A Logical Architecture is Always a Flexible Architecture (ASEAN)
A Logical Architecture is Always a Flexible Architecture (ASEAN)A Logical Architecture is Always a Flexible Architecture (ASEAN)
A Logical Architecture is Always a Flexible Architecture (ASEAN)
Denodo
 
When and How Data Lakes Fit into a Modern Data Architecture
When and How Data Lakes Fit into a Modern Data ArchitectureWhen and How Data Lakes Fit into a Modern Data Architecture
When and How Data Lakes Fit into a Modern Data Architecture
DATAVERSITY
 
AFAC session 2 - September 8, 2014
AFAC session 2 - September 8, 2014AFAC session 2 - September 8, 2014
AFAC session 2 - September 8, 2014
KBIZEAU
 
Ad

Recently uploaded (20)

AI and Data Privacy in 2025: Global Trends
AI and Data Privacy in 2025: Global TrendsAI and Data Privacy in 2025: Global Trends
AI and Data Privacy in 2025: Global Trends
InData Labs
 
TrsLabs - Fintech Product & Business Consulting
TrsLabs - Fintech Product & Business ConsultingTrsLabs - Fintech Product & Business Consulting
TrsLabs - Fintech Product & Business Consulting
Trs Labs
 
How analogue intelligence complements AI
How analogue intelligence complements AIHow analogue intelligence complements AI
How analogue intelligence complements AI
Paul Rowe
 
HCL Nomad Web – Best Practices and Managing Multiuser Environments
HCL Nomad Web – Best Practices and Managing Multiuser EnvironmentsHCL Nomad Web – Best Practices and Managing Multiuser Environments
HCL Nomad Web – Best Practices and Managing Multiuser Environments
panagenda
 
Procurement Insights Cost To Value Guide.pptx
Procurement Insights Cost To Value Guide.pptxProcurement Insights Cost To Value Guide.pptx
Procurement Insights Cost To Value Guide.pptx
Jon Hansen
 
Rusty Waters: Elevating Lakehouses Beyond Spark
Rusty Waters: Elevating Lakehouses Beyond SparkRusty Waters: Elevating Lakehouses Beyond Spark
Rusty Waters: Elevating Lakehouses Beyond Spark
carlyakerly1
 
UiPath Community Berlin: Orchestrator API, Swagger, and Test Manager API
UiPath Community Berlin: Orchestrator API, Swagger, and Test Manager APIUiPath Community Berlin: Orchestrator API, Swagger, and Test Manager API
UiPath Community Berlin: Orchestrator API, Swagger, and Test Manager API
UiPathCommunity
 
Massive Power Outage Hits Spain, Portugal, and France: Causes, Impact, and On...
Massive Power Outage Hits Spain, Portugal, and France: Causes, Impact, and On...Massive Power Outage Hits Spain, Portugal, and France: Causes, Impact, and On...
Massive Power Outage Hits Spain, Portugal, and France: Causes, Impact, and On...
Aqusag Technologies
 
Technology Trends in 2025: AI and Big Data Analytics
Technology Trends in 2025: AI and Big Data AnalyticsTechnology Trends in 2025: AI and Big Data Analytics
Technology Trends in 2025: AI and Big Data Analytics
InData Labs
 
Linux Support for SMARC: How Toradex Empowers Embedded Developers
Linux Support for SMARC: How Toradex Empowers Embedded DevelopersLinux Support for SMARC: How Toradex Empowers Embedded Developers
Linux Support for SMARC: How Toradex Empowers Embedded Developers
Toradex
 
2025-05-Q4-2024-Investor-Presentation.pptx
2025-05-Q4-2024-Investor-Presentation.pptx2025-05-Q4-2024-Investor-Presentation.pptx
2025-05-Q4-2024-Investor-Presentation.pptx
Samuele Fogagnolo
 
Into The Box Conference Keynote Day 1 (ITB2025)
Into The Box Conference Keynote Day 1 (ITB2025)Into The Box Conference Keynote Day 1 (ITB2025)
Into The Box Conference Keynote Day 1 (ITB2025)
Ortus Solutions, Corp
 
Role of Data Annotation Services in AI-Powered Manufacturing
Role of Data Annotation Services in AI-Powered ManufacturingRole of Data Annotation Services in AI-Powered Manufacturing
Role of Data Annotation Services in AI-Powered Manufacturing
Andrew Leo
 
AI EngineHost Review: Revolutionary USA Datacenter-Based Hosting with NVIDIA ...
AI EngineHost Review: Revolutionary USA Datacenter-Based Hosting with NVIDIA ...AI EngineHost Review: Revolutionary USA Datacenter-Based Hosting with NVIDIA ...
AI EngineHost Review: Revolutionary USA Datacenter-Based Hosting with NVIDIA ...
SOFTTECHHUB
 
Drupalcamp Finland – Measuring Front-end Energy Consumption
Drupalcamp Finland – Measuring Front-end Energy ConsumptionDrupalcamp Finland – Measuring Front-end Energy Consumption
Drupalcamp Finland – Measuring Front-end Energy Consumption
Exove
 
Electronic_Mail_Attacks-1-35.pdf by xploit
Electronic_Mail_Attacks-1-35.pdf by xploitElectronic_Mail_Attacks-1-35.pdf by xploit
Electronic_Mail_Attacks-1-35.pdf by xploit
niftliyevhuseyn
 
Quantum Computing Quick Research Guide by Arthur Morgan
Quantum Computing Quick Research Guide by Arthur MorganQuantum Computing Quick Research Guide by Arthur Morgan
Quantum Computing Quick Research Guide by Arthur Morgan
Arthur Morgan
 
Splunk Security Update | Public Sector Summit Germany 2025
Splunk Security Update | Public Sector Summit Germany 2025Splunk Security Update | Public Sector Summit Germany 2025
Splunk Security Update | Public Sector Summit Germany 2025
Splunk
 
HCL Nomad Web – Best Practices und Verwaltung von Multiuser-Umgebungen
HCL Nomad Web – Best Practices und Verwaltung von Multiuser-UmgebungenHCL Nomad Web – Best Practices und Verwaltung von Multiuser-Umgebungen
HCL Nomad Web – Best Practices und Verwaltung von Multiuser-Umgebungen
panagenda
 
SAP Modernization: Maximizing the Value of Your SAP S/4HANA Migration.pdf
SAP Modernization: Maximizing the Value of Your SAP S/4HANA Migration.pdfSAP Modernization: Maximizing the Value of Your SAP S/4HANA Migration.pdf
SAP Modernization: Maximizing the Value of Your SAP S/4HANA Migration.pdf
Precisely
 
AI and Data Privacy in 2025: Global Trends
AI and Data Privacy in 2025: Global TrendsAI and Data Privacy in 2025: Global Trends
AI and Data Privacy in 2025: Global Trends
InData Labs
 
TrsLabs - Fintech Product & Business Consulting
TrsLabs - Fintech Product & Business ConsultingTrsLabs - Fintech Product & Business Consulting
TrsLabs - Fintech Product & Business Consulting
Trs Labs
 
How analogue intelligence complements AI
How analogue intelligence complements AIHow analogue intelligence complements AI
How analogue intelligence complements AI
Paul Rowe
 
HCL Nomad Web – Best Practices and Managing Multiuser Environments
HCL Nomad Web – Best Practices and Managing Multiuser EnvironmentsHCL Nomad Web – Best Practices and Managing Multiuser Environments
HCL Nomad Web – Best Practices and Managing Multiuser Environments
panagenda
 
Procurement Insights Cost To Value Guide.pptx
Procurement Insights Cost To Value Guide.pptxProcurement Insights Cost To Value Guide.pptx
Procurement Insights Cost To Value Guide.pptx
Jon Hansen
 
Rusty Waters: Elevating Lakehouses Beyond Spark
Rusty Waters: Elevating Lakehouses Beyond SparkRusty Waters: Elevating Lakehouses Beyond Spark
Rusty Waters: Elevating Lakehouses Beyond Spark
carlyakerly1
 
UiPath Community Berlin: Orchestrator API, Swagger, and Test Manager API
UiPath Community Berlin: Orchestrator API, Swagger, and Test Manager APIUiPath Community Berlin: Orchestrator API, Swagger, and Test Manager API
UiPath Community Berlin: Orchestrator API, Swagger, and Test Manager API
UiPathCommunity
 
Massive Power Outage Hits Spain, Portugal, and France: Causes, Impact, and On...
Massive Power Outage Hits Spain, Portugal, and France: Causes, Impact, and On...Massive Power Outage Hits Spain, Portugal, and France: Causes, Impact, and On...
Massive Power Outage Hits Spain, Portugal, and France: Causes, Impact, and On...
Aqusag Technologies
 
Technology Trends in 2025: AI and Big Data Analytics
Technology Trends in 2025: AI and Big Data AnalyticsTechnology Trends in 2025: AI and Big Data Analytics
Technology Trends in 2025: AI and Big Data Analytics
InData Labs
 
Linux Support for SMARC: How Toradex Empowers Embedded Developers
Linux Support for SMARC: How Toradex Empowers Embedded DevelopersLinux Support for SMARC: How Toradex Empowers Embedded Developers
Linux Support for SMARC: How Toradex Empowers Embedded Developers
Toradex
 
2025-05-Q4-2024-Investor-Presentation.pptx
2025-05-Q4-2024-Investor-Presentation.pptx2025-05-Q4-2024-Investor-Presentation.pptx
2025-05-Q4-2024-Investor-Presentation.pptx
Samuele Fogagnolo
 
Into The Box Conference Keynote Day 1 (ITB2025)
Into The Box Conference Keynote Day 1 (ITB2025)Into The Box Conference Keynote Day 1 (ITB2025)
Into The Box Conference Keynote Day 1 (ITB2025)
Ortus Solutions, Corp
 
Role of Data Annotation Services in AI-Powered Manufacturing
Role of Data Annotation Services in AI-Powered ManufacturingRole of Data Annotation Services in AI-Powered Manufacturing
Role of Data Annotation Services in AI-Powered Manufacturing
Andrew Leo
 
AI EngineHost Review: Revolutionary USA Datacenter-Based Hosting with NVIDIA ...
AI EngineHost Review: Revolutionary USA Datacenter-Based Hosting with NVIDIA ...AI EngineHost Review: Revolutionary USA Datacenter-Based Hosting with NVIDIA ...
AI EngineHost Review: Revolutionary USA Datacenter-Based Hosting with NVIDIA ...
SOFTTECHHUB
 
Drupalcamp Finland – Measuring Front-end Energy Consumption
Drupalcamp Finland – Measuring Front-end Energy ConsumptionDrupalcamp Finland – Measuring Front-end Energy Consumption
Drupalcamp Finland – Measuring Front-end Energy Consumption
Exove
 
Electronic_Mail_Attacks-1-35.pdf by xploit
Electronic_Mail_Attacks-1-35.pdf by xploitElectronic_Mail_Attacks-1-35.pdf by xploit
Electronic_Mail_Attacks-1-35.pdf by xploit
niftliyevhuseyn
 
Quantum Computing Quick Research Guide by Arthur Morgan
Quantum Computing Quick Research Guide by Arthur MorganQuantum Computing Quick Research Guide by Arthur Morgan
Quantum Computing Quick Research Guide by Arthur Morgan
Arthur Morgan
 
Splunk Security Update | Public Sector Summit Germany 2025
Splunk Security Update | Public Sector Summit Germany 2025Splunk Security Update | Public Sector Summit Germany 2025
Splunk Security Update | Public Sector Summit Germany 2025
Splunk
 
HCL Nomad Web – Best Practices und Verwaltung von Multiuser-Umgebungen
HCL Nomad Web – Best Practices und Verwaltung von Multiuser-UmgebungenHCL Nomad Web – Best Practices und Verwaltung von Multiuser-Umgebungen
HCL Nomad Web – Best Practices und Verwaltung von Multiuser-Umgebungen
panagenda
 
SAP Modernization: Maximizing the Value of Your SAP S/4HANA Migration.pdf
SAP Modernization: Maximizing the Value of Your SAP S/4HANA Migration.pdfSAP Modernization: Maximizing the Value of Your SAP S/4HANA Migration.pdf
SAP Modernization: Maximizing the Value of Your SAP S/4HANA Migration.pdf
Precisely
 
Ad

Building the Security Operations and SIEM Use CAse

  • 1. 1© 2018 Don Murdoch / SANS Security Operations Summit, 2018 1 SecOps, SIEM, and Security Architecture Use Case Development Don Murdoch, GSE #99 Asst. Director, Institute for Cyber Security, Regent University, Virginia Beach, VA Author, Blue Team Handbook: Incident Response Latin "sapere aude" means "Dare to Be Wise"
  • 2. © 2018 Don Murdoch / SANS Security Operations Summit, 2018 2 Session Agenda • Requirements development in support of SecOps/SecArch focused use cases • Define the security operations use case development process and key considerations • Provide real life examples from a SIEM platforms and custom implementations
  • 3. © 2018 Don Murdoch / SANS Security Operations Summit, 2018 3 Requirements – Spot the need vs. feature Needs: Things that the stakeholders believe that the system needs to do; problems that they need to have solved. Features: Informal / imprecise statements of capabilities of the system used often for marketing and product-positioning purposes, as a shorthand for a set of behaviors of the system.
  • 4. © 2018 Don Murdoch / SANS Security Operations Summit, 2018 4 Requirements Development is Essential • Software development goal • Develop [acceptable] quality software, on time and on budget that meets a real need • Satisfy Requirements, or the individual statements of conditions and capabilities to which the system must conform • Use Cases express and show how to realize the requirements • Studies advise: • 50% of businesses experience IT [cloud] project failure (Innotas, 2013) • Only 16.2% of 8,360 software projects had ideal results (Standish, 2014)
  • 5. © 2018 Don Murdoch / SANS Security Operations Summit, 2018 5 The Maturing Iron Triangle • Value- to the end user in terms of a deliverable product • Quality- continuous delivery of value according to the customer’s requirements • Constraints- a traditional scope, schedule and scope Source: https://www.knowledgehut.com/blog/agile-management/agile-project-management-triangle-a-golden-product-in-organizations Scope Cost Constraint (S,S,C) PMBOK Value (Extrinsic Quality) Agile Quality (Intrinsic)Schedule 1090’s -> 2010’s
  • 6. © 2018 Don Murdoch / SANS Security Operations Summit, 2018 6 Use Cases Defined • Definition: • Actions or steps that define the interactions between a role and a system to achieve a specific goal. Roles are outside. • Actor: a person or things that interact with the system • Use Case: Things of value the system provides to its actors • SecOps: Use cases define the flow of data and how the Security Team interacts with the system to monitor and detect adverse conditions
  • 7. © 2018 Don Murdoch / SANS Security Operations Summit, 2018 7 Phases SIEM/SecOps Process Understand business Need. What is the security question that must be answered? How is it tied to the value chain? Develop Requirements Guidance Tools, Frameworks (CISec, ASD 35, Regulatory, 800-53 etc.) Instrument Source System Develop SIEM Content Enable and Train SecOps Validation Cycle Operating Constraints: Can it be done? Does the source generate a consumable log? User ID? How can we collect the data? What enrichment helps?
  • 8. © 2018 Don Murdoch / SANS Security Operations Summit, 2018 8 SecOps Use Case Template • Name • Purpose • Problem Statement • Requirement Statement(s) • Design Specification • Security Operations Notification Process and Key Data • Incident Response / Investigation Process for the Analyst • Use Case Component Names • Use Case Component Names • Use Case Data Source Descriptions • Data Analysis – Go Diamond • Kill Chain Analysis – Traditional KC – ICS Specific KC • Audit support • Assumptions / Limitations • Alternatives to this Use Case
  • 9. © 2018 Don Murdoch / SANS Security Operations Summit, 2018 9 Be Wise Up Front (1/2) • Name – placeholder in the library, control tie in • Purpose • To describe a specific use case for topic X and explain how the UC will be satisfied by system Y • Problem Statement • Describe the business objective / process / problem • Provide direction without stating a solution • Ideally, it expresses a solvable problem
  • 10. © 2018 Don Murdoch / SANS Security Operations Summit, 2018 10 Be Wise Up Front (2/2) • Requirements – Correct, unambiguous, and feasible – Must support the use case – in scope – Ideally, requirements communicate priority. – Measurable or verifiable in some way which will manifest through the source data and actions that the system will take. – Testable (design of experiment)
  • 11. © 2018 Don Murdoch / SANS Security Operations Summit, 2018 11 Use SMART Design Specifications • Specific – target a specific area. • Measurable – quantify an indicator of progress. • Assignable – specify who, what, where • Realistic – state what results can realistically be achieved, given available resources • Time-related – specify when the result(s) can be achieved. • Because Use Cases need to be successful too!
  • 12. © 2018 Don Murdoch / SANS Security Operations Summit, 2018 12 Sec Ops Team Notification – Key Actors • Ensure that all necessary data arrives to the SoC – Enrichment is important for SoC analyst success – Automate as much as possible for rapid review • Provide process guidance for content context – A note to explain the “attribute” – Define further analyst investigation paths / opening move to shorten the MTTD (detect)
  • 13. © 2018 Don Murdoch / SANS Security Operations Summit, 2018 13 Component Names – Maintenance • Document the Use Case components for the “entire system” • Data feeds, plug ins, configuration files, parsers, normalizers • Device names • Rules, lists, directives, enrichment/reference sources • Content components such as internal lists, dashboards, output reports, etc. • This section is critical for “debugging”
  • 14. © 2018 Don Murdoch / SANS Security Operations Summit, 2018 14 Example UC’s for Account Misuse and ALCE’s – Audit Logon and Account Logon • AD DDGPO, DDC GPO, Local GPO – is this thing on? • Log reader – every X Seconds, read and forward • Alert notification must be able to parse and identify the condition – Constituent system policy - “defer” to the central directory for account name and needs to log attempts – Privileged “security context” (group) changes
  • 15. © 2018 Don Murdoch / SANS Security Operations Summit, 2018 15 Data Process – Windows Event Logs Windows Event Log Local Audit Policy Consumer (Nxlog, WMI, OSSEC, WinLogBeats Proprietary) Normalization, Enrichment, Apply Taxonomy Manager, analysis engine, Alert Gen AD Adv. Audit Policy Security Analyst How many opportunities are there for the system to break down? Context Clues!
  • 16. © 2018 Don Murdoch / SANS Security Operations Summit, 2018 16 Instrument and test the system!
  • 17. © 2018 Don Murdoch / SANS Security Operations Summit, 2018 17 SIEM Example - Privileged Group Changes Can you find the gap? 4728: A member was added to a security-enabled global group
  • 18. © 2018 Don Murdoch / SANS Security Operations Summit, 2018 18 How “we” spent 204 hours or $13,872 to “monitor PeopleSoft HCMS and FIN” • Multilevel security rights/roles model – 67 pages • Design 17 conditions to satisfy Financial Controls • 17 select’s that rolled into one, 17 unit tests, meetings.. • 24 page BRD, 70+ page DD, 17 step test plan, 6 Stored procedures and collectors, rights, deployments (Q,D,P) with change control • Custom collector codebase – one per environment - multiple dashboards, two email notifications, audit report – Ensure you predict prod impact because Dev and QA will not mimic production while you design/develop
  • 19. © 2018 Don Murdoch / SANS Security Operations Summit, 2018 19 Hundreds of Other Use Cases • Accounts not conformant to standards or in use in a constituent system but not defined in the central directory • Successful brute force • Local A/V event followed by outbound URL to suspicious IP and a PDF file open on the PC • Proxy says “Suspect site”, then AV event, then ‘first IP use without prior DNS lookup’
  • 20. 20© 2018 Don Murdoch / SANS Security Operations Summit, 2018 20 Thank you!