From reactive to automated reducing costs through mature security processes info security europe 2011
Download as PPTX, PDF•0 likes•764 views
This document discusses how organizations can move from reactive security processes to more automated security processes to reduce costs. It highlights how IT process automation can help bridge silos between business and IT by centralizing tools on a single platform. This allows organizations to address key issues like insider threats, compliance requirements, and business exception management through automated workflows. The document provides examples of how automated workflows for incident management and compliance exception management can help improve security, reduce manual work, and ensure processes are consistently followed.
From reactive to automated reducing costs through mature security processes info security europe 2011
- 1. From Reactive To Automated:Reducing Costs Through Mature Security ProcessesJörn DierksChiefSecurityStrategist [email protected]
- 2. Solving Cross-Discipline Problems2ProcessPeopleTechnologyInfrastructure & ApplicationsProvisioningHRComplianceHelpdeskNetIQNOCIncidentSecurityChangeBusinessOwnersOther Mgmt VendorsBusiness Processes
- 3. ProcessPeopleTechnologyInfrastructure & ApplicationsProvisioningHRCross-Product Integration ComplianceHelpdeskNetIQNOCIncidentSecurityChangeBusinessOwnersOther Mgmt VendorsBusiness ProcessesSolving Cross-Discipline Problems3
- 4. The Role of IT Process Automation –Bridging Silos Between Business and ITToolsToolsBusinessConfiguration & Identity AuditingService / Help DeskSecurity Info & Event ManagementEvent Correlation & AnalysisIT GRCMSLMIT ProcessAutomationVulnerability AssessmentSystems & App Monitoring Perimeter & Network SecurityNetwork MonitoringContent Monitoring / DLPResponse TimeMonitoringOperationsSecurityPolicyAwarenessConfiguration & Patch ManagementCMDBAV / Malware ProtectionIdentity ManagementResponsibilities Shared between Security & OperationsContinuityManagementCapacity & AvailabilityManagementReleaseManagementIncident & Problem Management Configuration & ChangeManagement
- 5. 5Security & CompliancePerformance & Availability Identity & Access5© 2010 NetIQ Corporation. All rights reserved.About NetIQManage and audit user entitlements
- 6. Track privileged user activity
- 7. Protect the integrity of key systems and files
- 8. Monitor access to sensitive information
- 9. Simplify compliance reportingIT ProcessAutomationMonitor and manage heterogeneous environments including custom applications
- 10. IT Service validation and end-user performance monitoring
- 11. Dynamic provisioning of large-scale monitoring with exceptions
- 12. Functional and hierarchical Incident escalation
- 13. Deliver & manage differentiated service levels
- 14. User Provisioning Lifecycle Management
- 15. Centralize Unix account management through Active Directory
- 16. Reduce number of privileged users
- 18. Windows and Exchange MigrationAddressing Insider ThreatPrivileged User MonitoringAddressing Compliance RequirementsBusiness Exception ManagementEnd-User Policy Management andAwarenessUse-Cases In This Presentation
- 19. Security Breachesinvolving Sensitive Business Data
- 20. Another Challenge toConsider…Source: “Data Loss RisksDuring Downsizing“, Ponemon Institute LLC, 23 Feb 2009
- 21. Policies, procedures and standardsClear guidelinesPolicies as a key for your organizationStandardize assetsIdentity & access controlData ClassificationAccess controlManage islands of identity(Privileged) User monitoringAuditsNot a one-time effortRegular auditsThorough auditsRegulationsDifficult to do manuallyReporting neededThree Important Subjects9Photo by: Giorgio Monteforti: http://www.flickr.com/photos/11139043@N00/1439804758/
- 22. Mapping Subjects To TechnologyBACWorkflow & Process AutomationIdentity & AccessManagementIT Infrastructure Windows Systems
- 23. Unix & Linux Systems
- 24. Mac OS Systems
- 25. Security & Network Devices
- 26. Applications
- 27. Users
- 28. Groups
- 29. etc.Active DirectoryPolicy Management& User AwarenessConfiguration &Compliance ManagementPrivileged User Monitoring, SIEM
- 30. Security Process AutomationFORRESTER® Required Optional* Determined using the Aegis ROI calculator developed by Forrester Consulting based on a representative customer with 1,000 servers.
- 31. Use Case #1Insider ThreatIncident Automation withPrivileged User Monitoring
- 32. Automated IncidentManagement Workflow13DataWarehouseCMDBChange ManagementIncident Management ConsoleWorkflow / ProcessEventAdministratorAutomated event detection & response:Reduces time to response
- 35. Lowers impact on administratorsRemediation
- 36. Use Case #2Business Exception Management Automation in Compliance Management
- 37. 8Workflow / Process1. Policy Templates assess complianceNetIQ Secure Configuration Manager detects non-compliant systems3SystemOwner2.Secure Configuration Manager tells Aegis about the Compliance problemAegis starts Non-Compliance Workflow943. Aegis emails the system ownerInforms about the problems foundApproval & ExceptionManagement ProcessSystem Owner analyzes the issuesThen he tells Aegis that he wants to create an exception for one of the issues752105. Aegis informs the Security Officer about the exception creation requestEnsures that no exceptions get created without approval6Compliance & Configuration ManagementSecurityOfficer6.Security Officer approves exception requestHe can do that either by email or through the Aegis web consoleResults:No exceptions get created without prior approval
- 38. Security Processes are followed through
- 39. Compliance Issues are tracked consistently
- 40. There’s always a consistent result of a workflow7.Aegis creates the exception in NetIQ Secure Configuration Manager and approves the exceptionAll details about the approvals process are added into the notes section of the exception1018. Administrator is notified about the exception approval and creationAlso, he’s asked if he wants to re-run the policy templateManual WorkloadAutomated Workload9.The System Owner confirms…10. Aegis tells Secure Configuration Manager to re-run the Policy TemplatesBusiness System
- 41. Where do I start? – Process Automation Lifecycle
- 42. Policies, proceduresandstandardsClear guidelinesPoliciesas a keyforyourorganizationStandardizeassetsAchievePolicy ComplianceConfiguration & Compliance ManagementAutomatedException & Approval ManagementMonitor Privileged User ActivitySIEM & Access MonitoringAutomatedIncident Management, Escalation & AlertingSummary – Remember… 1… 2… 3…!BACWorkflow & Process AutomationIdentity & AccessManagementIT Infrastructure Windows Systems
- 43. Unix & Linux Systems
- 44. Mac OS Systems
- 45. Security & Network Devices
- 46. Applications
- 47. Users
- 48. Groups
- 49. etc.Active DirectoryPolicy Management& User AwarenessConfiguration &Compliance ManagementPrivileged User Monitoring, SIEM